Decode a JSON Web Token, read its claims, and check the
signature against a secret or public key — all in your browser. It also
flags the things that actually get tokens forged, like
alg: none and algorithm confusion.
Decoded in your browser. Nothing is uploaded, stored, or put in the URL.
HS* takes a shared secret. RS*/PS*/ES* take a public key —
never a private one. The sample token above verifies with
super-secret-demo-key-do-not-use-in-prod.
How this works. Decoding and verification happen entirely in
this page using the browser's built-in WebCrypto API. There are no network
requests, no storage, and the token never enters the URL — so it cannot leak
through history, referrers, or server logs. Even so:
do not paste production tokens into any web tool, including this one.
The JOSE parsing here is written by hand because an inspector has to display
the malformed tokens a real library correctly refuses, and because this tool
only ever verifies — it never issues or signs anything. In production
auth code, use a maintained library such as jose instead.