What is the difference between decoding and verifying a JWT?

Decoding simply base64-decodes the header and payload sections — it does not check the signature or expiration. Anyone can decode a JWT without the secret. Verification checks that the signature matches (proving the token was signed by someone with the secret) and that the token has not expired.

Can I use this tool to verify RS256 tokens?

This tool currently supports HS256 (symmetric HMAC) verification only, which requires a shared secret. RS256 tokens use an RSA private/public key pair — verification requires the public key. For RS256, use a library like jsonwebtoken (Node.js) with the public key from your authorization server's JWKS endpoint.

Is it safe to paste my token here?

Yes. All processing happens in your browser — the token and secret never leave your device. However, treat your JWT tokens like passwords: avoid pasting production tokens with long expiration times into any third-party tool. Short-lived tokens (15-60 minutes) are far safer to inspect.

Why does my token show as valid even with the wrong secret?

This happens only if you leave the secret field empty — the tool then skips signature verification and only decodes the payload. Enter your secret to perform full signature verification.

How do I validate a JWT token?

Paste the token, enter your HS256 secret, and verify the signature. Your production code should also check exp, iss, and aud claims and reject unexpected alg values — never trust decode-only inspection alone.

Can I verify a JWT without the secret?

You can decode the header and payload without a secret, but you cannot confirm authenticity. Verification requires the signing secret or public key. Treat decoded-only tokens as untrusted.

Ferramenta

Validador JWT

Verifique assinaturas e claims localmente com seu segredo ou chave pública.

Last updated July 1, 2026

Roda inteiramente no seu navegador — nenhum dado é enviado a servidores. Política de privacidade

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Os controles da ferramenta permanecem em inglês por precisão. A geração não sai do seu navegador.

JWT token

Secret key (optional — for HS256 signature verification)

Paste a JWT and click "Validate token" to inspect header, payload, and expiration.

Never paste production tokens into online validators. All verification is client-side.

CLI equivalents (verify HS256)

node -e "console.log(require('jsonwebtoken').verify(process.argv[1], process.env.JWT_SECRET, {algorithms:['HS256']}))" -- "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig"

Página completa em inglês com guias e perguntas frequentes