JSON Web Token · decode · verify HS/RS/PS/ES · sign
🔐 JWT Decoder & Builder
Decode a JWT's header and claims, check its signature with a shared secret (HS) or the issuer's public key (RS/PS/ES, as PEM, JWK or JWKS), or build and sign a new token.
Header
Payload
Claims
Signature & verification
—
—
—
A JWT is three Base64URL parts (header.payload.signature); the payload is NOT encrypted, only encoded, so never trust it before checking the signature. HS256/384/512 are verified and signed here with the shared secret. RS256/384/512 (RSASSA-PKCS1-v1_5), PS256/384/512 (RSA-PSS, salt = hash length), ES256/384/512 (ECDSA P-256/384/521, raw r||s) and EdDSA are verified with the issuer's public key as PEM, JWK or JWKS; the kid in the header picks the key. Signing with those needs the private key and is not done here.