Read the token. Then verify it.

A JSON Web Token is a compact string with three Base64URL parts separated by periods: a header naming the signing algorithm, a payload of claims such as the subject, issuer, audience, and expiry, and a signature over the first two parts. RFC 7519 defines it. Anyone who holds the token can read the header and the payload, because encoding is not encryption. The signature is what lets a server tell a genuine token from a forged one.

Decoding only turns the Base64URL parts back into JSON. It proves nothing about who issued the token or whether the claims were changed on the way. IndieJWT shows the header, the claims, and the time status from the decode alone, and labels the result as not verified until you add a public key or JWKS URL and the signature checks out. Treat a decoded token as readable text, not as trusted data.

Paste the token. IndieJWT reads the exp, nbf, and iat claims and shows their UTC timestamps. The default comparison uses the current device clock with zero clock skew. Choose a custom UTC evaluation time to reproduce an expiry or not-before boundary; the result records that instant in UTC and your local timezone. A custom comparison is a simulation, not the current token status or signature proof. Missing and unusable time claims stay explicit. Copy time check JSON includes those time claims and the evaluation basis without other claims or key material.

Paste the token, then paste the issuer's public key as a BEGIN PUBLIC KEY PEM block or as JWK JSON, or enter the HTTPS address of its JWKS. The browser picks the key that matches the token's alg and kid, then runs the check with WebCrypto. RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and ES512 are supported.

HS256 and the other HMAC algorithms need the shared secret, and IndieJWT never asks for a secret or a private key, so those tokens are decoded but not verified. A JWKS address must allow cross-origin reads, or the browser cannot fetch it and the result says so.

No. A valid signature proves the token was signed by the key you supplied and has not been altered since. It does not prove the issuer is the one your application trusts, that the audience is your service, or that the claims are still current. Enter the issuer and audience you expect, and IndieJWT compares them exactly. A verified signature with a mismatch is headlined as a mismatch, not a success, and an expired token stays expired however good its signature is.

Whether the token has been revoked, whether the public key you pasted really belongs to the issuer, and whether your server would accept it: those depend on your application, not on the token. IndieJWT reads one compact signed JWT with three parts. An encrypted JWE with five parts is not decoded, a token with alg set to none has no signature to verify, and a token with critical header extensions is refused for verification.

Yes. No account, no card, no premium plan, no upgrade nag, no hidden paywall. IndieJWT is free, all of it.

There is no public lookup history. A network check sends the public input needed for that check to its named source. Local file tools process file contents in your browser. Cookieless analytics counts visits and fixed actions, never entered values or file contents. Anything the tool saves for you stays in your browser.