What is a JSON Web Token (JWT)?

A JWT is a compact, URL-safe string used to securely transmit claims between parties. It consists of three Base64-encoded parts separated by dots: header (algorithm), payload (claims) and signature.

Does the JWT decoder verify the signature?

The Decode tab displays the header and payload without signature verification. Use the Verify tab to check the signature — with the shared secret for HS256/384/512 tokens, or with the issuer's public key (PEM, JWK or JWK Set) for RS/PS/ES tokens.

Does the decoder explain what each claim means?

Yes. Every recognized claim gets a plain-English description — the RFC 7519 registered claims (iss, sub, aud, exp…), OpenID Connect claims, and common vendor claims from Microsoft Entra ID (Azure AD), AWS Cognito, Firebase, Keycloak and Auth0. Timestamp claims are also shown as local dates with relative time.

Can I decode an expired JWT?

Yes. The decoder shows the raw payload including the 'exp' (expiry) claim regardless of whether the token is expired. Expiry is flagged visually, with relative time ('expired 2 days ago'), judged against your device clock.

Can I pass a token in the URL?

Yes. Open /devsec/jwt#token=… (also #access_token= or #id_token=) and the token decodes immediately — so the page works as an OAuth redirect target during development. URL fragments are never sent over the network, so the token stays on your device.

Is my JWT sent to any server?

No. Decoding, signing and verification all run entirely in your browser using the Web Crypto API — your token is never transmitted to GoChronos or any third party. This is safe even for tokens with sensitive payloads.

What signing and verification algorithms are supported?

Signing supports HS256, HS384 and HS512 (HMAC). Verification additionally supports the asymmetric algorithms RS256/384/512 (RSA), PS256/384/512 (RSA-PSS) and ES256/384/512 (ECDSA) using the issuer's public key.

JWT Generator — Sign Tokens Locally

Build and HMAC-sign a JSON Web Token from your own claims and secret. The signing happens in your browser, so a production secret never leaves the machine.