What is the difference between decoding and verifying a JWT?

Decoding simply base64-decodes the header and payload sections — it does not check the signature or expiration. Anyone can decode a JWT without the secret. Verification checks that the signature matches (proving the token was signed by someone with the secret) and that the token has not expired.

Can I use this tool to verify RS256 tokens?

This tool currently supports HS256 (symmetric HMAC) verification only, which requires a shared secret. RS256 tokens use an RSA private/public key pair — verification requires the public key. For RS256, use a library like jsonwebtoken (Node.js) with the public key from your authorization server's JWKS endpoint.

Is it safe to paste my token here?

Yes. All processing happens in your browser — the token and secret never leave your device. However, treat your JWT tokens like passwords: avoid pasting production tokens with long expiration times into any third-party tool. Short-lived tokens (15-60 minutes) are far safer to inspect.

Why does my token show as valid even with the wrong secret?

This happens only if you leave the secret field empty — the tool then skips signature verification and only decodes the payload. Enter your secret to perform full signature verification.

How do I validate a JWT token?

Paste the token, enter your HS256 secret, and verify the signature. Your production code should also check exp, iss, and aud claims and reject unexpected alg values — never trust decode-only inspection alone.

Can I verify a JWT without the secret?

You can decode the header and payload without a secret, but you cannot confirm authenticity. Verification requires the signing secret or public key. Treat decoded-only tokens as untrusted.

Tool

JWT Token Validator

Decode and verify JWT tokens. Inspect the header and payload, check expiration, and validate HS256 signatures — all in your browser.

Last updated July 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

JWT token

Secret key (optional — for HS256 signature verification)

Paste a JWT and click "Validate token" to inspect header, payload, and expiration.

Never paste production tokens into online validators. All verification is client-side.

CLI equivalents (verify HS256)

node -e "console.log(require('jsonwebtoken').verify(process.argv[1], process.env.JWT_SECRET, {algorithms:['HS256']}))" -- "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.sig"

Paste your JWT token into the "Token" field. The tool will immediately decode and display the header and payload sections in formatted JSON — no secret required for decoding.

To verify the signature, enter your HS256 secret key in the "Secret" field and click "Verify". The tool will confirm whether the signature is valid and check if the token is expired based on the "exp" claim.

Use this tool to debug authentication issues, inspect token contents during development, or verify that your signing logic is producing well-formed tokens before deploying. Expand CLI equivalents below for Node.js and Python verify one-liners.

const jwt = require('jsonwebtoken');

// Decode without verification (inspect claims only)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header); // { alg: 'HS256', typ: 'JWT' }
console.log(decoded.payload); // { userId: 123, exp: 1700000000 }

// Verify signature and expiration
try {
  const payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
  console.log('Valid token:', payload);
} catch (err) {
  console.error('Invalid token:', err.message);
}

const jwt = require('jsonwebtoken');

// Decode without verification (inspect claims only)
const decoded = jwt.decode(token, { complete: true });
console.log(decoded.header); // { alg: 'HS256', typ: 'JWT' }
console.log(decoded.payload); // { userId: 123, exp: 1700000000 }

// Verify signature and expiration
try {
  const payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
  console.log('Valid token:', payload);
} catch (err) {
  console.error('Invalid token:', err.message);
}

import jwt

# Decode without verification
decoded = jwt.decode(token, options={"verify_signature": False})
print(decoded)  # {'userId': 123, 'exp': 1700000000}

# Verify signature and expiration
try:
    payload = jwt.decode(token, secret, algorithms=['HS256'])
    print('Valid token:', payload)
except jwt.ExpiredSignatureError:
    print('Token has expired')
except jwt.InvalidTokenError as e:
    print('Invalid token:', str(e))

import "github.com/golang-jwt/jwt/v4"

// Parse and verify
token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
    if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
        return nil, fmt.Errorf("unexpected signing method: %v", t.Header["alg"])
    }
    return []byte(secret), nil
})

if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
    fmt.Println("userId:", claims["userId"])
} else {
    fmt.Println("Invalid token:", err)
}

Continue learning

ToolsJWT DecoderJWT Secret GeneratorJWT EncoderJWKS Viewer

GuidesValidate a JWT Token — QuickstartJWT Claims Checklist (iss, aud, exp, nbf)Fix Invalid Signature JWT ErrorsNode.jsPythonGoJavaRuby

ArticlesDebug JWT Invalid SignatureHow to Decode a JWT Without the SecretHow to Validate a JWT TokenCommon JWT Vulnerabilities

GlossaryJSON Web Token (JWT)JWT HeaderJWT Payloadexp (Expiration) ClaimAlgorithm Confusion Attackalg:none (Unsecured JWT)JWT Clock SkewJWT Token Replay

CompareHS256 vs RS256JWT vs Session CookiesJWS (JWT) vs Opaque TokenHS256 vs ES256

AlgorithmsHS256 (HMAC-SHA256)

ResourcesProduction JWT path

How to Use This Tool

Continue learning