indielab.dev
Back to Home
JWT Validator
Decode JWT header and payload, validate time-based claims, and optionally verify HS256 signature.
Ready.
Header
Payload
Checks
How it works
A JWT is three Base64URL-encoded segments joined by dots: header.payload.signature. We split on the dot, decode the header and payload with atob() and TextDecoder, then display both as formatted JSON. For HS256 signature verification, we re-sign the header.payload string using the crypto.subtle.sign() API with your secret, and compare the result against the token's signature segment.
Frequently Asked Questions
Is it safe to paste a production JWT here?
Yes — decoding and verification run entirely in your browser. Your token and secret are never sent to a server. That said, if the token contains a live session credential with a short expiry, treat it as sensitive and rotate it after debugging.
Why does signature verification only support HS256?
HS256 uses a shared secret, which you can paste directly into the tool. RS256 and ES256 use asymmetric key pairs — verifying them in-browser would require you to paste a full public key in PEM format, which is a less common workflow we may add later.
Privacy Guaranteed
All data processing, encoding, and formatting are executed locally inside your browser using client-side JavaScript. We never upload your text, inputs, or private data to any server. Your information remains 100% secure.