A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties. It consists of three parts separated by dots: Header (algorithm & token type), Payload (claims/data), and Signature (cryptographic verification). JWTs are commonly used for authentication and secure information exchange in web applications, APIs, and OAuth 2.0 flows.

To verify a JWT signature, you need the algorithm specified in the header's alg field and the corresponding key. For HMAC-based algorithms (HS256, HS384, HS512), you need the shared secret key. For RSA or ECDSA algorithms (RS256, ES256, etc.), you need the public key (usually in PEM format). Paste your key in the verification section above and click "Verify Signature." All verification happens locally in your browser — your keys are never sent anywhere.

HS256 (HMAC-SHA256) uses a single shared secret key for both signing and verification — ideal for internal services where the same party creates and validates tokens. RS256 (RSA-SHA256) uses a private key for signing and a public key for verification — better for distributed systems where many services need to verify tokens without access to the signing key. RS256 is generally recommended for public-facing APIs and multi-service architectures.

These are standard time-based claims in a JWT payload: exp (Expiration Time) — the token is invalid after this Unix timestamp; nbf (Not Before) — the token is not valid before this time; iat (Issued At) — when the token was created. Always validate these claims on the server side. This debugger highlights expired tokens with a warning badge and converts all timestamps to human-readable dates.

Yes. All decoding and verification is performed entirely in your browser using JavaScript. Your JWT tokens and secret keys are never transmitted to any server, stored, or logged. The source code is visible in this page — you can verify this yourself. For extra security with production tokens, consider using incognito mode and clearing your clipboard after use. Never share your secret keys or tokens publicly.

Signature validity and token expiration are independent checks. A token can have a valid signature (meaning it hasn't been tampered with) but still be expired (the exp claim's time has passed). Both must be validated for secure authentication. This tool checks both and reports them separately so you can diagnose issues precisely.