ToolsWeb & certificates

JWT decoder

Paste a JSON Web Token to read its header and claims, see what its dates mean and what to watch for. Add the key to check its signature.

Runs entirely in your browser: the token and key never leave this page

Token

JSON Web Token

Three parts separated by dots: header, payload and signature. An encrypted token (JWE) has five. A "Bearer" prefix, quotes and line breaks are ignored. Results update as you paste.

Check the signature (optional)

Key

For HS256, HS384 and HS512, the shared secret. For the others, the issuer's public key: PEM, a certificate, a JWK, or a JWK Set (the key matching the token's kid is used).

Secret format (HS algorithms only)

Text Base64

How this works

Everything happens in this page's JavaScript, on your device. The token is split at its dots, and each part is Base64url-decoded (RFC 7515 §2).
The header and payload are read as JSON. Claims such as exp and iat are seconds since 1970 (RFC 7519 §2), compared with your device's clock.
If you add a key, your browser's built-in Web Crypto checks the signature over the first two parts, exactly as they appear in the token (RFC 7515 §5.2).
Nothing is sent to abbott.cloud or anywhere else, so the request log below stays empty.

What's kept: nothing. The token and key aren't added to this page's address, so they stay out of your browser history. A link to this page that ends in #q= followed by a token opens that token once, then clears it from the address. Browsers never send the part after # to a website. Older links with ?q= still work, but your browser sends that part of the address to abbott.cloud when it opens the page.

Limitations:

Encrypted tokens (JWE) are recognised and their header explained, but they can't be read without the recipient's key, which this page doesn't ask for.
Keys aren't fetched from jku or x5u addresses or the issuer's key set: paste the key yourself.
Browsers can't check ES256K signatures, and most can't check Ed448.
A valid signature only proves who signed the token. The recipient must still check the issuer, audience and dates.

Code: jwt.js (this page), lib/jwt.js (decoding, checks and signatures), x509.js and asn1.js (PEM keys and certificates).