How to use
- Paste the token.
- Read the decoded header and payload.
- Optionally enter the secret to check the signature.
Questions
Is it safe to paste a real token here?
The token and secret stay in your browser and are not sent anywhere. Still, treat live tokens like passwords.
Which signatures can it check?
HS256, HS384 and HS512, which use a shared secret. Tokens signed with public keys (RS, ES, PS) are decoded but not checked yet.
Is a decoded token trustworthy?
Not by itself. Anyone can read or change a JWT’s payload. Only a valid signature shows it hasn’t been changed.