JWT Validator
Verify HS256 and RS256 signatures and validate exp, nbf, aud and iss claims
Expected claims
Allows small clock differences when checking exp and nbf.
Decode-only inspection: JWT Decoder · Sign test tokens: JWT Signer
About this tool
Decoding a JWT shows claims but does not prove the token is trustworthy. Signature verification confirms the issuer signed the token, and time claims (exp, nbf) plus aud/iss checks catch misconfiguration early.
Paste a token, supply HS256 secret or RS256 public key, and optionally validate audience and issuer. Results show per-claim badges alongside the payload JSON. Use with JWT Decoder for inspection.
How to use
Paste JWT
Paste the Bearer token or cookie value.
Verify signature
Enter HMAC secret or RSA public key PEM.
Check claims
Review exp, nbf, aud and iss validation badges.
Use cases
API integration tests
Confirm tokens from auth service match expected aud/iss before shipping.
Incident response
Verify whether a leaked token is still valid and correctly signed.
Frequently asked questions
Related guides
Related tools
AES Encryption
Encrypt and decrypt text with AES-GCM and a passphrase, fully in your browser. Uses PBKDF2 key derivation and the Web Crypto API — your data and keys never leave your device.
Basic Auth Generator
Generate an HTTP Basic Authentication header from a username and password. Produces the Authorization header and ready-to-use curl and fetch snippets. Runs fully client-side.
Bcrypt Generator & Verifier
Hash passwords with bcrypt and verify hashes — choose your cost factor (rounds 4–15), get a secure hash instantly, and check whether a password matches a hash. Runs entirely in your browser.
BIP39 Mnemonic Generator
Generate and validate BIP39 seed phrases locally for testing
Checksum Calculator
Compute file checksums (SHA-1, SHA-256, SHA-384, SHA-512) in your browser with the Web Crypto API
Client-Side File Encryptor
Encrypt any file with AES-256-GCM and PBKDF2 directly in your browser — no uploads, no accounts, wrong passwords fail loudly.