# JWT Parser Guide

Decode, live-edit and verify JSON Web Tokens.

- Tool: https://ilham.dev/tools/jwt-parser/
- Guide URL: https://ilham.dev/guides/jwt-parser/
- Tool guides index: https://ilham.dev/guides/tools/
- Broader guide: Understanding and Debugging JWTs (https://ilham.dev/guides/jwt-debugging/)

## What it does

Decode, live-edit and verify JSON Web Tokens. Paste an existing token to inspect it, click the header or payload to edit the JSON and rebuild the token live, then check whether the signature still matches. Signature checking covers HMAC (HS256/384/512), RSASSA-PKCS1_v1_5 (RS256/384/512), RSA-PSS (PS256/384/512) and ECDSA (ES256/384/512).

## Use the tool

Open https://ilham.dev/tools/jwt-parser/, add the input the tool asks for, run it, and check the output before using it elsewhere.

## Input and output

- Input: text.
- Output: text.
- Category: Web.

## Privacy and processing
Processing happens locally in your browser. This tool does not upload the input to ilham.dev.

## Common use cases
- inspect a JWT without verifying it
- check when a token expires

## Questions

### Does this verify the signature?

Yes, in the Check the signature panel, for HS, RS, PS and ES algorithms. Paste the shared secret for HMAC tokens or the PEM public key for the rest, and it recomputes the signature over the header and payload exactly as they arrived. That is why editing the payload by even one character flips the answer to a mismatch.

### Does a valid signature mean the token is trustworthy?

No. It only means the token was signed by whoever holds the key you pasted. It says nothing about whether that issuer is one you trust, and it does not enforce exp, nbf, aud or iss — those are separate checks your application still has to make.

### Why is alg: none refused?

Because alg: none means the token is unsigned, so anyone who can edit it can also rewrite the payload. A verifier that accepts the algorithm named in the token is the classic algorithm-confusion bug; here the algorithm is read from the header so the right primitive is chosen, and none is always reported as a failure.

### Is it safe to paste a token here?

The decoding and the signature check both happen in your browser and nothing is uploaded. Even so, a token is a live credential — use a throwaway one when you are testing, and never paste a production secret.