Paste a token and see its header, claims and signature in plain text, with the format identified from the string itself. Sign a new JWT or check an existing one against the algorithm you pick from the list. Everything runs in your browser: no upload, no key ever leaves the device.
The decoding, signing and verification all run inside the page with local libraries, so nothing is uploaded or stored. Treat the result with the same care as the token: a screenshot or pasted text still exposes a working credential until it expires.
No. The header and payload are base64url encoded, not encrypted, so the tool reads them without any key. A key is needed only for the Verify mode, where the signature is actually checked, and for Sign mode when you create a token.
Because a token that chooses its own algorithm can pick one the verifier should never accept. This is how the alg none bypass and the HS256 versus RS256 confusion attack work. In Verify mode you select the expected algorithm and the tool compares it with the token header instead of following it.
46 formats are detected automatically, including compact and JSON JWT, JWS, five-part JWE, SD-JWT with its disclosures, CBOR Web Tokens such as EAT and Token Status List, PASETO, Macaroon, Biscuit, SAML, Fernet and Branca. The detected format, its specification and the reason for the match are printed above the header panel.
Paste the token your client sends and read the claims: wrong audience, missing role, or an expiry already in the past explains most 401 responses without touching the code.
Decode SD-JWT disclosures or a CBOR Web Token and see the claims under their standard names instead of the integer keys the binary format carries.
See which key management and encryption algorithms a JWE uses, and confirm that the payload really is ciphertext rather than a JWT that is being parsed as one.