JWT Validator
JWT Validator inspects JSON header and payload objects, reports numeric exp and nbf timing issues, and optionally verifies an HS256 signature locally.
JWT Validator inspects JSON header and payload objects, reports numeric exp and nbf timing issues, and optionally verifies an HS256 signature locally.
JWT Validator is a free JWT Tools utility that runs entirely in your browser — nothing you enter is uploaded.
How to use JWT Validator
- Paste the three-segment JWT into the input field.
- Enter the matching UTF-8 text secret for HS256 verification, or leave it empty to inspect without signature verification.
- Choose Validate and read the signature status and any numeric exp or nbf issues separately.
- Review issuer, audience, issued-at policy and application requirements elsewhere before trusting a token.
About this tool
Parses a compact token with JSON header and payload objects, reports numeric exp and nbf timing issues, and optionally verifies HS256 with a UTF-8 text secret. A valid signature is not an overall authorization verdict. iat, issuer, audience, claim types and application policy are not validated.
Time comparisons use this device’s current clock, without a clock-skew allowance. Missing or nonnumeric exp and nbf values do not produce timing warnings. Other signature algorithms are not verified. JSON numbers use JavaScript number representation; this report is not a complete JWT or JOSE policy validator.
Frequently asked questions
What does JWT Validator check?
Parses a compact token with JSON header and payload objects, reports numeric exp and nbf timing issues, and optionally verifies HS256 with a UTF-8 text secret. A valid signature is not an overall authorization verdict. iat, issuer, audience, claim types and application policy are not validated.
Does a valid signature mean the token is authorized?
No. It means the supplied secret matches the HS256 signature. The application must separately enforce its accepted issuer, audience, claims and permissions.
Does it check iat?
No. The tool checks timing only when exp or nbf is numeric. It does not validate iat or enforce claim types.
What happens without a secret?
The report displays the parsed header and payload and marks the signature as not verified. Decoding alone does not establish authenticity.
How is the secret interpreted?
It uses the exact UTF-8 text entered. It does not automatically decode a Base64 or hexadecimal key representation.