What is the difference between decoding and verifying a JWT?

Decoding simply base64-decodes the header and payload sections — it does not check the signature or expiration. Anyone can decode a JWT without the secret. Verification checks that the signature matches (proving the token was signed by someone with the secret) and that the token has not expired.

Can I use this tool to verify RS256 tokens?

This tool currently supports HS256 (symmetric HMAC) verification only, which requires a shared secret. RS256 tokens use an RSA private/public key pair — verification requires the public key. For RS256, use a library like jsonwebtoken (Node.js) with the public key from your authorization server's JWKS endpoint.

Is it safe to paste my token here?

Yes. All processing happens in your browser — the token and secret never leave your device. However, treat your JWT tokens like passwords: avoid pasting production tokens with long expiration times into any third-party tool. Short-lived tokens (15-60 minutes) are far safer to inspect.

Why does my token show as valid even with the wrong secret?

This happens only if you leave the secret field empty — the tool then skips signature verification and only decodes the payload. Enter your secret to perform full signature verification.

How do I validate a JWT token?

Paste the token, enter your HS256 secret, and verify the signature. Your production code should also check exp, iss, and aud claims and reject unexpected alg values — never trust decode-only inspection alone.

Can I verify a JWT without the secret?

You can decode the header and payload without a secret, but you cannot confirm authenticity. Verification requires the signing secret or public key. Treat decoded-only tokens as untrusted.

Herramienta

Validador JWT

Verifica firmas y claims en local con tu secreto o clave pública.

Last updated July 1, 2026

Se ejecuta por completo en tu navegador — no se envían datos a servidores. Política de privacidad

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Los controles de la herramienta permanecen en inglés por precisión. La generación no sale de tu navegador.

JWT token

Secret key (optional — for HS256 signature verification)

Paste a JWT and click "Validate token" to inspect header, payload, and expiration.

Never paste production tokens into online validators. All verification is client-side.

CLI equivalents (verify HS256)

node -e "console.log(require('jsonwebtoken').verify(process.argv[1], process.env.JWT_SECRET, {algorithms:['HS256']}))" -- "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig"

Página completa en inglés con guías y preguntas frecuentes