Decode and verify a JWT
Paste a JSON Web Token to see its header and claims with readable dates, check whether it has expired, and verify the signature with a PEM key, a JWKS document, a shared secret or the certificate chain in its x5c header. Tokens never leave your browser.
What you can do
- Header and claims with human-readable dates
- Expiry, not-before and issued-at checks
- Signature verification for RS, PS, ES, EdDSA and HS algorithms
- Keys from PEM, JWK, JWKS or the x5c certificate chain
- Warnings for alg none, weak keys and missing expiry
Frequently asked questions
Is it safe to paste a real token?
The token is decoded and verified in this tab and never sent anywhere. JWKS, jku and x5u URLs are not fetched. A token is still a credential, so don't share screenshots of one.
What is the difference between decoding and verifying a JWT?
Anyone can decode a JWT, because the header and claims are just Base64url. Verifying checks the signature with the issuer's key, which proves the token wasn't changed or forged.
Why is alg “none” dangerous?
It means the token has no signature. A library that accepts it lets anyone write their own claims, so PKIScope flags it.
Related tools
- JWK converter — PEM ↔ JSON Web Key, JWKS viewer and key thumbprints
- Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs
- Hash generator — Checksums, HMAC and bcrypt, Argon2, scrypt and PBKDF2 password hashes