Cryptographically verify HMAC signatures, inspect payload claims with live expiration countdowns, and debug tokens in real time. Zero server uploads.
Production-ready code snippets to decode and cryptographically verify this token in multiple backend languages.
A JSON Web Token (RFC 7519) consists of three parts separated by dots: Header, Payload, and Signature.
| Claim Key | Standard Name | Description & RFC 7519 Specification |
|---|---|---|
iss |
Issuer | Identifies the principal that issued the JWT (e.g. https://auth0.com, https://accounts.google.com). |
sub |
Subject | Identifies the principal that is the subject of the JWT (typically a unique user ID or system service identifier). |
aud |
Audience | Identifies the recipients that the JWT is intended for. The recipient service must verify that its identity matches the audience. |
exp |
Expiration Time | Identifies the expiration time on or after which the token must not be accepted for processing. Formatted as Unix epoch timestamp. |
nbf |
Not Before | Identifies the time before which the JWT must not be accepted for processing. |
iat |
Issued At | Identifies the time at which the JWT was created. Useful for calculating token age and revocation checks. |
jti |
JWT ID | Provides a unique identifier for the token. Can be used to prevent token replay attacks by tracking consumed tokens. |
Everything you need to inspect, debug, and understand JSON Web Tokens without security compromises.
Signatures are validated directly inside your browser using the high-performance W3C Web Crypto API. Your secret keys never leave your machine.
Instant parsing of exp, iat, and nbf timestamps with human-readable relative countdowns and local timezone conversions.
Clear visual color distinction matching the RFC spec: Poppy Red for Header, Sky Blue for Payload, and Emerald for the cryptographic Signature.
Modify claims in the JSON editor and watch the encoded JWT string and HMAC signature recalculate in real time automatically.
Export verified decoding code snippets for Node.js, Python, Go, Rust, and PHP tailored to your token's active algorithm.
No analytics cookies, no token logging, and no remote API calls. Your sensitive authorization credentials stay 100% confidential.
Three straightforward steps to inspect and validate any JWT client-side.
Copy your JWT from your browser's Developer Tools or API response and paste it into the left Encoded Token pane.
Examine the parsed JSON in real time. Check standard claims like exp, iss, and sub in the claims inspector.
Enter your secret key for HS256 tokens to perform mathematical verification using the browser's native Web Crypto API.
All token parsing, Base64URL conversions, and cryptographic HMAC computations happen strictly on your local machine. Your tokens and secret keys are never transmitted over the internet or stored anywhere.
Common questions about JSON Web Tokens, cryptographic verification, security considerations, and privacy.
Yes. Redsite tools run 100% client-side in your browser. When you paste a token or secret key into this tool, zero bytes are transmitted over the network. All decoding, JSON formatting, and cryptographic HMAC validations execute locally using the browser's native JavaScript engine and Web Crypto API.
A standard JWT (JSON Web Signature) is signed, not encrypted. The Header and Payload are simply Base64URL-encoded JSON text. This means anyone who has the token can decode and read its contents. The secret key is only required to verify that the token has not been tampered with and was genuinely issued by a trusted party.
This tool uses the standard W3C Web Crypto API (window.crypto.subtle). When you enter your secret key, the browser imports the key and executes an HMAC-SHA256 (or SHA-384 / SHA-512) digest calculation across header.payload. If the resulting base64url hash matches the token's signature segment, the token is verified as authentic and untampered.
JWS (JSON Web Signature) provides integrity and authentication—the payload is readable by anyone, but tampering invalidates the signature. JWE (JSON Web Encryption) provides confidentiality—the payload is encrypted using symmetric or asymmetric encryption so only authorized recipients with the private key can decrypt and read the contents.
The exp (Expiration Time) claim specifies a Unix timestamp (seconds since January 1, 1970). Our tool compares this value against your current local clock. If the current timestamp is greater than exp, the token is expired and will be rejected by compliant authentication servers.
Yes. Once this page loads in your browser, all scripts, styles, and cryptographic operations are completely self-contained. You can disconnect your network connection or use it on an offline device without any disruption.
A fast, clean, private suite of developer utilities designed with zero bloat and 100% client-side privacy.
Format, beautify, and minify SQL queries across MySQL, PostgreSQL, SQLite, and T-SQL with zero server uploads.
Test regular expressions in real time, inspect capture groups, test string replacements, and export polyglot code.
Validate, format, indent, and inspect JSON payloads with line numbers and real-time syntax error diagnosis.
Remove permissions and decrypt password-protected PDF files 100% locally in your browser. Zero uploads.
Format, beautify, and validate complex XML trees with syntax error highlighting and tree visualizer.
Convert YAML configuration files to clean JSON and vice-versa instantly with schema validation.