What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe way to represent claims between two parties — most commonly used to prove who a user is after they log in. It has three Base64URL-encoded parts separated by dots: a header (which algorithm signed it), a payload (the actual claims, like user ID or expiry), and a signature (proof the first two parts weren't tampered with). Anyone can decode a JWT — it isn't encrypted — but only someone holding the signing secret or private key can produce a signature that verifies.
How to use this tool
- 1 Paste a token into the field above, or hit Load signed sample to generate one instantly.
- 2 The header and payload decode automatically — switch each panel between Claims (human-readable) and JSON view.
- 3 To verify the signature, enter the signing secret below (HS256, HS384 and HS512 only).
- 4 Watch the status line — a green check confirms the signature genuinely matches; red means it doesn't.
Frequently asked questions
Is my token or secret sent anywhere?
No. Decoding and signature verification both run locally using the browser's built-in Web Crypto API. Your token and secret never leave your machine.
Which algorithms can this tool verify?
HS256, HS384 and HS512 (HMAC-based signatures) verify fully — just paste the shared secret. RS256, ES256 and other public-key algorithms need the signer's public key to verify, which this tool doesn't yet accept; header and payload still decode normally regardless of algorithm.
What does "Valid JWT" actually check?
It confirms the token has three Base64URL segments and that the header and payload both parse as JSON. It does not confirm the signature is genuine — that's a separate check, shown once you enter the signing secret.
Why does the secret have a "base64url encoded" checkbox?
Some systems generate signing secrets as raw bytes and represent them as Base64URL rather than plain text. Check the box if your secret was provided that way; otherwise it's treated as a literal UTF-8 string.
What is the "Load signed sample" button doing?
It generates a fresh example token, signs it live with HS256 using Web Crypto and a well-known demo secret, and fills in both fields — so you can see a real, correctly verified signature immediately instead of a static screenshot.