JWT validator · Guide
JWT Validator Online: Verify an HS256 Signature
A JWT validator goes one step beyond a decoder: it recomputes the signature from the header, payload and your secret, and checks it matches. This guide explains what verification proves and how to do it safely in the browser.
Verifying versus decoding
Decoding reads the claims; verifying proves the token was signed by someone who holds the secret and has not been altered since. For HS256 the same secret signs and verifies, so you supply it to check the signature.
The validator computes the HMAC-SHA256 of the header and payload using your secret and compares it to the token signature. A match means the token is authentic for that secret.
Keep the secret local
Because verification needs the secret, it must never be sent to a server. This validator runs in the browser with the Web Crypto API, so the secret and token stay on your machine.
Reading the result
A valid result confirms authenticity for the given secret; an invalid result means either the secret is wrong or the token was modified. It does not, on its own, check expiry — decode the payload to confirm exp as well.
Frequently asked questions
Which algorithm does this support?
It verifies HS256 (HMAC-SHA256) tokens using a shared secret. Asymmetric algorithms like RS256 use a public/private key pair and are verified differently.
Is my secret uploaded?
No. Verification runs in the browser with the Web Crypto API, so the secret and token never leave your machine.
Ready to try it?
Open the free browser-based JWT validator and apply what you just read — no sign-up, runs locally.
Open the JWT validator tool