Decode a JSON Web Token, see at a glance whether it is expired, verify HS256, RS256, ES256 or EdDSA signatures and edit and re-sign the claims – all in your browser.
Paste a token – with or without the Bearer prefix – and the header and payload appear side by side. exp, iat and nbf are shown as dates, and a coloured box tells you whether the token is valid right now, expired or not valid yet.
Add the secret or the issuer's public key (PEM, certificate, JWK or a whole JWKS, picked by kid) to verify the signature. Edit a claim and the token is re-encoded on the spot; with the secret or a private key it is re-signed too – handy for testing how your API treats expired or tampered tokens.
Tokens and keys never leave the page, and a token passed in a link is removed from the address bar immediately.