Runs locally in your browser. Nothing you enter is uploaded to our servers.
Result will appear here
Tips for validating JWTs
Local checks help debugging; production must verify signatures with the real key.
Reject tokens with alg=none or algorithm confusion attacks.
Validate expiry and audience claims explicitly.
Do not paste production signing secrets into this tool.
Clock skew can cause false exp/nbf failures — check device time.
Check a JWT signature you already have a key for
Processing stays in your browser — your input is not uploaded to our servers.
Validation verifies the signature with a secret or public key you provide and can flag expired `exp` claims. It is for tokens you own in a test setting.
This is not an OAuth playground against a live issuer. Do not paste customer production keys.
Validate a JWT
Paste the token and the key
HMAC needs the shared secret; RSA/EC needs the public key that matches the issuer.
Run the check
A failure may be a wrong key, a truncated token, or clock skew on `exp`/`nbf`.
Clear both fields
Keys and tokens together are enough to impersonate. Do not leave them in the tab.
JWT validate FAQ
Why did decode work but validate fail?
The payload can be read without a key. A failed validate means the signature does not match that key.
Do you send the secret to a server?
No. Verification is local in the browser.
Can I validate without a key?
You can only decode. Signature check always needs the corresponding secret or public key.