Validate JWT Online
Paste a JWT to run full validation: check the structure, verify the signature, confirm it is not expired, and inspect all claims — everything runs locally in your browser.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
What does full JWT validation involve?
Full JWT validation goes beyond decoding — it verifies that the token is structurally valid, cryptographically authentic, and semantically correct. The steps are: (1) confirm the token has three Base64Url-encoded parts separated by dots; (2) decode and validate the header; (3) decode the payload; (4) verify the signature against the issuer's key; (5) validate exp (not expired), nbf (not before), iss (issuer), and aud (audience) claims.
Signature verification is the most critical step — without it, you are just reading data that anyone could have modified. After verifying the signature, iss and aud validation ensures the token was issued for your specific system. An attacker from another service cannot use their legitimate token against your API if you correctly validate aud. Expiry validation ensures tokens do not live forever.
Paste your JWT and enter the verification key above to perform all these checks locally. The tool will show you exactly which validation steps pass and which fail — making it ideal for debugging authentication issues without exposing sensitive tokens to external services.
JWT validation checklist
- 1. Structure
- Token has exactly 3 dot-separated Base64Url-encoded parts.
- 2. Header
- alg is in your allowlist; typ is JWT.
- 3. Signature
- Signature verifies against the key matching the kid.
- 4. exp
- Current time is before the expiration timestamp.
- 5. nbf
- Current time is at or after the not-before timestamp.
- 6. iss
- Issuer matches your expected authorization server.
- 7. aud
- Audience includes your API's identifier.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.