Passport control · data page · stamps
JWT Decoder
A token is a passport: who issued it, who it is for, when it was issued and when it expires, signed so it cannot be altered. Paste one and it is read at the desk, the expiry stamped, the claims listed. Add the secret or public key and the signature is checked too.
Present the token
Verify the signature
Header
Payload
Reading a token at the desk
A JSON Web Token is three Base64 parts joined by dots: a header naming the algorithm, a payload of claims, and a signature over the first two. Anyone can read the first two, which is the point: a client, a proxy, a debugger can all see who the token is for and when it lapses. Only the signature needs the key, and only the issuer's key can produce it, so a token that verifies is a passport nobody has tampered with.
The claims
iss is the issuing authority, sub the holder, aud where it is valid, iat when it was issued, nbf the first moment it may be used and exp the last. Dates are Unix seconds; the desk prints them in your local time and stamps the expiry red or green against the clock. Everything else in the payload is listed under the stamps.
Verification
HS256, HS384 and HS512 are HMACs: paste the shared secret. RS, PS and ES algorithms are public-key signatures: paste the issuer's public key as PEM or JWK. The check runs in the browser's Web Crypto and nothing is transmitted. A token that decodes but fails verification was altered, signed with another key, or pasted incompletely.
Why does the sample token verify?
It is minted in your browser when the page loads, signed with the secret already in the box. Change one character of the payload and Verify will refuse it.
Is it safe to paste a real token here?
The page runs entirely in your browser and makes no network requests with your data, but a token is a credential: treat it like a password and prefer expired or test tokens when you can.
What is the strip at the bottom of the page?
A machine-readable zone in the style of a passport, two lines of 44 characters padded with chevrons, built from the token's claims. It is decoration that happens to be readable.