Question 1

Is decoding the same as verifying a JWT?

Accepted Answer

No. Decoding only reveals the header and payload. Verification checks the signature using a secret or public key to ensure the token hasn’t been tampered with.

Question 2

Can this tool verify JWT signatures?

Accepted Answer

Yes. Provide an HMAC secret (HS*), an RSA/ECDSA public key (PEM/JWK), or a JWKS URL to verify the signature. Verification is optional and runs locally.

Question 3

Does it support JWKS endpoints?

Accepted Answer

Yes. You can supply a JWKS URL to fetch keys (kid-aware). This request is only made if you opt in; otherwise everything stays offline.

Question 4

Can it decode encrypted JWTs (JWE)?

Accepted Answer

Encrypted JWEs require decryption keys and are not simply base64url-decoded. The tool focuses on JWS (signed) tokens for inspection and verification.

Question 5

Is my token uploaded anywhere?

Accepted Answer

No. By default, the tool runs entirely in your browser. Data isn’t sent to a server. JWKS fetching happens only if you enable it.

Tools Cube

JWT Decoder & Verifier

Verify signature