How this one works
A JWT is three Base64URL strings joined by dots: a header saying how it was signed, a payload of claims, and a signature. The field colours each part as you type, and a part that fails to decode is underlined.
Each claim is listed with what it means, covering the standard claims, OpenID Connect and the ones Microsoft, Amazon Cognito and Firebase add. Times such as exp are shown in your local time zone. Switch a panel to JSON to copy it.
The signature is checked with your browser's WebCrypto. HS256, HS384 and HS512 need the shared secret; RS, PS, ES and EdDSA tokens need the issuer's public key, as PEM, a certificate, a JWK or the whole JWKS. The checks list what a reviewer would flag, such as a missing exp or an unsigned token.
Questions
Is it safe to paste a real token here?
Nothing you paste leaves the tab: decoding and verifying are plain JavaScript and WebCrypto, with no server to send to. Still, a live token pasted anywhere is worth treating as exposed. Rotate it if it grants real access.
Does decoding prove the token is genuine?
No. The header and payload are only encoded, so anyone can write a token that decodes. Only a valid signature shows the claims came from whoever holds the key, which is why the signature is checked on the same screen.
Where do I find the public key for an RS256 token?
Identity providers publish their keys as a JWKS, usually at /.well-known/jwks.json on the issuer's domain (the iss claim). Open it, copy the whole JSON and paste it into the key field. The key matching the token's kid is picked for you.
Why does it say my token has five parts?
Five dot-separated parts means a JWE, an encrypted token. Its payload can only be read with the decryption key, so it can't be decoded here.