# JWT Parser

Decode, live-edit and verify JSON Web Tokens.

## URL

https://ilham.dev/tools/jwt-parser/

## What It Does

Decode, live-edit and verify JSON Web Tokens. Paste an existing token to inspect it, click the header or payload to edit the JSON and rebuild the token live, then check whether the signature still matches. Signature checking covers HMAC (HS256/384/512), RSASSA-PKCS1_v1_5 (RS256/384/512), RSA-PSS (PS256/384/512) and ECDSA (ES256/384/512).

## Features

- Runs in the browser
- No login required

## Input

text input.

## Output

text output.

## Privacy

Processing happens locally in the browser.

No input data is uploaded to ilham.dev.

- Requires login: false
- Requires API key: false
- Stores user data: false


## Use Cases

- inspect a JWT without verifying it
- check when a token expires

## Examples

- How do I read the claims in a JWT?
- When does this token expire?




## Questions

### Does this verify the signature?

Yes, in the Check the signature panel, for HS, RS, PS and ES algorithms. Paste the shared secret for HMAC tokens or the PEM public key for the rest, and it recomputes the signature over the header and payload exactly as they arrived. That is why editing the payload by even one character flips the answer to a mismatch.

### Does a valid signature mean the token is trustworthy?

No. It only means the token was signed by whoever holds the key you pasted. It says nothing about whether that issuer is one you trust, and it does not enforce exp, nbf, aud or iss — those are separate checks your application still has to make.

### Why is alg: none refused?

`alg: none` means there is no signature. Anyone could change the claims, so the tool will not call it verified. For real authentication, an application must allow only the algorithms it expects; it must not trust the algorithm just because it appears in the token.

### Is it safe to paste a token here?

The decoding and the signature check both happen in your browser and nothing is uploaded. Even so, a token is a live credential — use a throwaway one when you are testing, and never paste a production secret.