JWT & Base64 Inspector

Decode tokens, check expiry and verify signatures locally. Nothing leaves your browser.

Mode

Paste a JWT, a Base64 string, or text to encode Secret (HS*) or PEM public key (RS*/ES*), optional. Use test keys, not production secrets.

How it works

A JWT has three Base64URL parts: header, payload and signature. This tool decodes the first two (including non-ASCII text), turns exp, iat and nbf into dates, and flags problems such as alg: none or a missing expiry.

Paste a secret or public key to verify the signature with your browser’s Web Crypto. Decoding is not trust: a token is only valid if its signature checks out against the right key.

Runs entirely in your browser; nothing is uploaded. As-is local-first edge utility, provided without warranty.