Read a token's header and claims, see when it expires in words rather than epoch seconds, and check the signature against your own secret or public key - all in this tab. A JWT is a bearer credential: anyone who holds it can act as its subject, which is reason enough not to paste one into someone else's server.
Paste it with or without the Bearer prefix.
HMAC tokens are checked with the shared secret.
Verification runs through the browser’s own WebCrypto implementation. Nothing on this page is transmitted: you can watch the network tab, or load the page and pull the cable.
{
"alg": "HS256",
"typ": "JWT"
}Times are shown as your local clock reads them, not as epoch seconds.
| Claim | Value |
|---|---|
subSubject - who the token is about | 4821 |
name | ريم الحلبي |
role | editor |
scopeGranted scopes | orders:read orders:write |
issIssuer - who minted the token | https://api.frugaldomain.site |
audAudience - who it is meant for | frugal-dashboard |
iatIssued at | 17500000006/15/2025, 6:06:40 PM · last year |
expExpires at | 17500036006/15/2025, 7:06:40 PM · last year |
Anyone can read a JWT - the payload is base64, not encryption. What proves it came from your server is the signature, and checking that needs the key. A tool that only decodes tells you what the token claims, not whether the claim is true.
A token whose header says alg: none carries no signature at all. Libraries that honour that header accept a token anyone could have written - the oldest JWT attack there is, and still found in the wild. This page marks it as an error rather than decoding it quietly.
RSA verification needs only the public half, which is published by design. Nothing legitimate asks you to paste a private key or an HMAC secret into a web page you do not control - including this one, which is why the whole check runs locally and the page says so.