JWT trust inspection
Inspect JWT claims locally and verify RS256 or ES256 signatures against an independently supplied public JWK and explicit claim policy.
Inspect locally. Verify only against a trusted public key.
No token, key or claim is uploaded by this tool. This page blocks network connections and form submissions; its code and visual assets still load from this site. Use test tokens rather than live credentials.
Decoding is not verification. A valid signature does not establish key provenance, revocation status, replay safety or permission to access an application.
Token and verification policy
Paste three dot-separated JWS segments, without a Bearer prefix. Limit: 32 KiB. Encrypted JWE tokens and detached payloads are unsupported.
Optional cryptographic verification
Choose the expected algorithm independently of the token. Supply one public JWK obtained through a trusted channel. Private keys, symmetric secrets, certificate chains and token-supplied key URLs are not accepted.
Issuer and audience are required and compared exactly. This diagnostic requires expiration, checks nbf/iat when present and uses this device’s current clock. Leaving expected type blank means type is not checked. RSA: 2048–4096 bits and exponent 65537. ES256: P-256 only.
Diagnostic scope, not an authentication decision
The supported profile does not evaluate subject ownership, nonce, permissions, revocation, replay, issuer availability or your application’s token-type rules. Claims are checked only after a valid signature, against the policy you supplied.
No remote key discovery, token refresh or application API request is performed. The tool does not replace a maintained authentication library or a server-side authorization check.