Validador JWT · Guía
JWT Validator Online: Verify an HS256 Signature
A JWT validator goes one step beyond a decoder: it recomputes the signature from the header, payload and your secret, and checks it matches. This guide explains what verification proves and how to do it safely in the browser.
Verifying versus decoding
Decoding reads the claims; verifying proves the token was signed by someone who holds the secret and has not been altered since. For HS256 the same secret signs and verifies, so you supply it to check the signature.
The validator computes the HMAC-SHA256 of the header and payload using your secret and compares it to the token signature. A match means the token is authentic for that secret.
Keep the secret local
Because verification needs the secret, it must never be sent to a server. This validator runs in the browser with the Web Crypto API, so the secret and token stay on your machine.
Reading the result
A valid result confirms authenticity for the given secret; an invalid result means either the secret is wrong or the token was modified. It does not, on its own, check expiry — decode the payload to confirm exp as well.
Preguntas frecuentes
Which algorithm does this support?
It verifies HS256 (HMAC-SHA256) tokens using a shared secret. Asymmetric algorithms like RS256 use a public/private key pair and are verified differently.
Is my secret uploaded?
No. Verification runs in the browser with the Web Crypto API, so the secret and token never leave your machine.
¿Listo para probarlo?
Abre la herramienta gratuita Validador JWT en el navegador y aplica lo que acabas de leer: sin registro y procesando localmente.
Abrir la herramienta Validador JWT