# IndieJWT

> Decode a JWT, read its expiry in plain words, and verify its signature locally with a public key or JWKS URL.

IndieJWT is a free, one-input web utility for indie makers at indiejwt.com. It takes one text, for example eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIxMjMifQ.signature, and answers in about ten seconds. Every answer names its source next to it. No account, no card, no premium plan, no upgrade nag, no hidden paywall. Private lookup activity is never published, and nothing on the page counts anyone. Every page is static HTML, and each link below is that page as Markdown or plain text. Made by turushan, https://twitter.com/turushan.

## Pages

- [IndieJWT](https://indiejwt.com/index.md): what the tool checks, what it takes, and what it promises
- [More tools](https://indiejwt.com/tools.md): the other tools by turushan, one line each
- [Notes](https://indiejwt.com/blog.md): the posts, newest first

## Notes

- [Why IndieJWT exists](https://indiejwt.com/blog/2026-09-03-why-indiejwt-exists.md): Decode a JWT locally, understand its clock claims, and keep verification separate from trust.

## Policies

- [security.txt](https://indiejwt.com/.well-known/security.txt): how to report a vulnerability, in the RFC 9116 shape