Skip to content

# JWT Decoder

Decode a JSON Web Token's header and payload and read its security warnings. Supply a key and the tool verifies the signature too.

This is generated in browser and is not sent to pah.moi servers.

About this tool3 paragraphs

Verification covers HS*, RS*, PS*, ES* and EdDSA against a secret, PEM public key, JWK or JWKS you supply, and the claim validation reads `exp`, `nbf`, `iat`, issuer and audience with a documented clock skew. Expert mode builds demo tokens and drops them back into the inspector.

A verified signature proves who signed a token, not that the token should be trusted: the banner says VERIFIED, never safe.

A JWT is a bearer credential, so the tool is gated behind a short acknowledgement. Your token, secret and keys never leave the browser and nothing here is logged.

Use it locally This tool has a native command line twin. Build `jwt-cli` from the site's source with:

    cargo build --release --bin jwt-cli

Source and licence terms