JWT decoder and local signature check

Decode a JWT compact JWS locally in your browser, with optional RSA JWK/JWKS input to check whether an RS256, RS384, or RS512 signature matches. The token, key, and decoded output are not sent to the backend or written to the URL, local storage, or backend logs.

Without a pasted public key, this page only decodes the Header and Payload. A local signature match only means the compact JWS signature matched the selected public key; it does not prove application authorization or business trust. Your server still has to validate expected iss, aud, exp, nbf, scope, roles, nonce, jti, and policy.