JWT Decoder & Verifier
Paste a token to read its claims and check its signature. Decoded in your browser — never uploaded or saved.
A JWT debugger you can trust with real tokens
Built for checking auth bugs fast — without sending bearer tokens to someone else’s server.
- Nothing leaves your browser
- Decoding and verification use the Web Crypto API on your device. Tokens are never stored, even locally.
- Readable claims
- exp, iat and nbf as real dates with “expires in 2 hours”. Standard claims labelled in plain English.
- Verify every common algorithm
- HS, RS, PS and ES (256/384/512) and EdDSA, with secrets, PEM keys, JWKs or a full JWKS.
- Security warnings
- Flags alg “none”, missing expiry, weak HMAC secrets, millisecond timestamps and pasted private keys.
- Paste anything
- Accepts “Authorization: Bearer …” headers, quotes and line breaks — they are cleaned up for you.
- Free & no sign-up
- Works offline once loaded. No ads in the way, no account.
Frequently asked questions
Is it safe to paste a production token here?+
CurlyJSON decodes and verifies tokens in your browser with the built-in Web Crypto API. Nothing is uploaded, logged or saved — not even in local storage — so the token is gone when you close the tab. Still, treat live tokens like passwords and prefer expired ones when you can.
Does decoding a JWT prove it is valid?+
No. Anyone can read a JWT’s header and payload; they are only base64url-encoded. A token is trustworthy only when its signature checks out with the right key and it has not expired. Use Verify signature to check it with your secret or public key.
Which algorithms can it verify?+
HS256, HS384 and HS512 with a shared secret (text or base64); RS256/384/512 and PS256/384/512 with an RSA public key; ES256, ES384 and ES512 with an EC public key; and EdDSA (Ed25519). Keys can be PEM, a JWK, or a whole JWKS — the right key is picked by the token’s kid.
Why does it refuse my private key?+
Verifying a signature only needs the public key. CurlyJSON rejects private keys so they are never pasted into a web page by mistake.
What do exp, iat and nbf mean?+
They are times in seconds since 1970 (Unix time): exp is when the token expires, iat when it was issued, and nbf the time before which it must not be accepted. CurlyJSON shows each one as a readable date and how long ago or from now it is.