JWT validator · Guide
JWT Signature Verification Explained
The signature is the part of a JWT that makes it trustworthy. Understanding what it covers explains why tokens cannot be quietly edited.
What the signature covers
The signature is computed over the encoded header and payload. Any change to either — even one character in a claim — produces a different signature, so tampering is detectable.
Symmetric vs asymmetric
HMAC algorithms like HS256 use one shared secret. Public-key algorithms like RS256 sign with a private key and verify with a public key, so verifiers cannot forge tokens. The verification step differs accordingly.
Frequently asked questions
Can I use this for production work?
Yes, for inspection, formatting and quick generation. Still review the output before committing it to production code or configuration.
Ready to try it?
Open the free browser-based JWT validator and apply what you just read — no sign-up, runs locally.
Open the JWT validator tool