Decodifica un JWT compacto y verifica firmas HMAC o de clave pública con un JWK o JWKS pegado. Comprueba issuer, audience y expiración localmente sin descargar claves.
For HS256/384/512, enter the raw shared secret. For asymmetric algorithms, paste a public JWK or JWKS JSON document.
Decode or verify a compact JWT to inspect its protected header and payload.
Anyone can decode a JWT payload. Treat a token as trusted only after a successful signature check with the intended algorithm and key, plus issuer, audience, time, and application-level claim validation.