# IndieJWT > Decode a JWT, read its expiry in plain words, and verify its signature locally with a public key or JWKS URL. Decode claims, read expiry, and verify signatures locally in your browser. The canonical page is https://indiejwt.com/. ## Use the tool Open [IndieJWT](https://indiejwt.com/) to complete the job. The questions below describe the supported input, result, and limits. Every answer names its source next to it. Source: [RFC 7519: JSON Web Token (JWT)](https://www.rfc-editor.org/rfc/rfc7519.html). ## Questions and limits ### What is a JWT? A JSON Web Token is a compact string with three Base64URL parts separated by periods: a header naming the signing algorithm, a payload of claims such as the subject, issuer, audience, and expiry, and a signature over the first two parts. [RFC 7519](https://www.rfc-editor.org/rfc/rfc7519.html) defines it. Anyone who holds the token can read the header and the payload, because encoding is not encryption. The signature is what lets a server tell a genuine token from a forged one. ### What does decoded but not verified mean? Decoding only turns the Base64URL parts back into JSON. It proves nothing about who issued the token or whether the claims were changed on the way. IndieJWT shows the header, the claims, and the time status from the decode alone, and labels the result as not verified until you add a public key or JWKS URL and the signature checks out. Treat a decoded token as readable text, not as trusted data. ### How do I check if a JWT is expired? Paste the token. IndieJWT reads the `exp`, `nbf`, and `iat` claims and shows their UTC timestamps. The default comparison uses the current device clock with zero clock skew. Choose a custom UTC evaluation time to reproduce an expiry or not-before boundary; the result records that instant in UTC and your local timezone. A custom comparison is a simulation, not the current token status or signature proof. Missing and unusable time claims stay explicit. Copy time check JSON includes those time claims and the evaluation basis without other claims or key material. ### How do I verify a JWT signature? Paste the token, then paste the issuer's public key as a `BEGIN PUBLIC KEY` PEM block or as JWK JSON, or enter the HTTPS address of its JWKS. The browser picks the key that matches the token's `alg` and `kid`, then runs the check with WebCrypto. RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and ES512 are supported. HS256 and the other HMAC algorithms need the shared secret, and IndieJWT never asks for a secret or a private key, so those tokens are decoded but not verified. A JWKS address must allow cross-origin reads, or the browser cannot fetch it and the result says so. ### Does a valid signature mean the token is safe to accept? No. A valid signature proves the token was signed by the key you supplied and has not been altered since. It does not prove the issuer is the one your application trusts, that the audience is your service, or that the claims are still current. Enter the issuer and audience you expect, and IndieJWT compares them exactly. A verified signature with a mismatch is headlined as a mismatch, not a success, and an expired token stays expired however good its signature is. ### What can IndieJWT not tell me? Whether the token has been revoked, whether the public key you pasted really belongs to the issuer, and whether your server would accept it: those depend on your application, not on the token. IndieJWT reads one compact signed JWT with three parts. An encrypted JWE with five parts is not decoded, a token with `alg` set to `none` has no signature to verify, and a token with critical header extensions is refused for verification. ## Promises - The core is free: no account, no card, no premium plan, no upgrade nag, no hidden paywall. - Private lookup activity is never published. - Analytics is currently off. Private lookup activity is never published or sent to a tracker. No lookup history becomes public inventory. ## More - [Notes](https://indiejwt.com/blog.md): posts by the maker, newest first - [More tools](https://indiejwt.com/tools.md): the other tools by turushan - [security.txt](https://indiejwt.com/.well-known/security.txt): how to report a vulnerability Made by turushan, https://twitter.com/turushan.