lc. Identity Tools
Tools

JWT decoder & verifier

Paste an id_token or access token to see its header, claims and validity window, and check the signature with a shared secret, a public key, a certificate or the issuer's JWKS.

Processed locally, in your browser
Input

A leading "Bearer " or an Authorization header line is stripped automatically.

Verify signature

Accepted: HMAC secret (HS*), PEM public key (SPKI), PEM certificate, a single JWK or a JWKS (picked by kid). Supports HS, RS, PS, ES and EdDSA.

Result

Paste a token to decode it.

What it checks

  • Decodes header and payload (base64url) and converts exp, nbf, iat and auth_time to readable dates.
  • Flags common problems: alg: none, missing exp, symmetric algorithms, long lifetimes, tokens that are expired or not yet valid.
  • Recognises Entra ID tokens (v1/v2 issuer, tid, oid, Microsoft Graph audience) and explains the usual surprises.
  • Verifies the signature with the Web Crypto API. Encrypted tokens (JWE) can only show their header.