JWT Decoder & Auditor
// decode · audit · understand JSON Web Tokens
Security audit
Header
Payload
Signature
not checked
Verify with
Paste keys only: this page never fetches a JWKS, jku or x5u URL. Inspect these keys
A valid signature proves who signed the token and that it hasn't changed. Your server must still pin the algorithm and check exp, iss and aud (see the audit above) with a trusted JWT library.