JWT Validate Validatorš 100% local
Validate JWT tokens. Privacy-first, no server uploads, no tracking.
Related Tools
Reads a token and reports what it can: the decoded header and payload, then exp, nbf, iat, iss and aud compared against the clock, then a verdict on the alg. Add a second line beginning secret: and it recomputes the HMAC over the first two parts and compares it with the third. The header and payload are decoded and the signature is recomputed locally, so the token never leaves the machine.
How to use it
- Paste the token as the first line.
- Add secret: your-secret on a second line if you want the HS256 signature checked as well.
- Press Process and read the four sections: Structure, Claims, Algorithm, Signature.
Worked example
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4ifQ.dGhpcy1pcy1ub3QtYS1yZWFsLXNpZ25hdHVyZQbecomes=== Structure ===
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"123","role":"admin"}
Sig len: 28 decoded chars
=== Claims ===
exp: (none - token never expires)
=== Algorithm ===
alg: HS256
=== Signature ===
Not verified - add "secret: <your-secret>" on line 2 to verify HS256 signatures.
Note: JWTs are base64-encoded, not encrypted - the payload is readable by anyone.This token carries no exp, nbf or iat, so the claims section is short. A token that has them gets one line per claim compared with the current time, which means the report describes the moment you ran it.
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjMiLCJyb2xlIjoiYWRtaW4ifQ.dGhpcy1pcy1ub3QtYS1yZWFsLXNpZ25hdHVyZQ
secret: my-secretbecomes=== Structure ===
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"123","role":"admin"}
Sig len: 28 decoded chars
=== Claims ===
exp: (none - token never expires)
=== Algorithm ===
alg: HS256
=== Signature ===
ā Signature INVALID - secret does not match.
Note: JWTs are base64-encoded, not encrypted - the payload is readable by anyone.The same token with a secret line added. The recomputed HMAC does not match the third part, so the signature check fails and the header and claims are still printed - a bad signature never stops the structure report.
When to use it
- A 401 comes back and you need to separate an expired exp from a not-yet-active nbf from a signature your service will not accept.
- Checking what alg a token announces before you let a library choose its verification path for you.
- Confirming that a token your own service issued was signed with the secret you believe it was.
What it does not do
- Signature checking covers HS256, HS384 and HS512 only. Paste an RS256, ES256 or PS256 token and the tool says it cannot verify it rather than guessing - use a library or your backend for asymmetric keys.
- Claim checks use your machine's clock. A token can read as valid here and still be refused by a server whose clock, tolerance for skew or revocation list differs.
- A matching signature proves only that the secret you supplied signs this payload. It says nothing about whether the issuer should be trusted, whether the audience is yours, or whether the token was withdrawn.
- Removing the secret line turns off the signature check entirely, and the report will happily describe a token with a forged third part as structurally fine.