JWT Validator

Overview

• Parses a JWT's Header and Payload, checks its expiration (exp), and — when you provide a Secret — also verifies the signature.
• While JWT Decoder focuses on inspecting contents, this tool goes further to check whether the token is actually valid.
• If you don't enter a Secret, the signature is treated as "Not verified" and only Header/Payload parsing and the exp/iat check are performed.

Usage

1. Enter the JWT you want to validate into the text area.
2. To also verify the signature, enter Secret (optional).
3. Click the "Validate" button to display the Header, Payload, exp/iat claims, and signature verification result.

Example

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.xxxxx

iat: -
exp: -
Signature: Not verified (no secret entered)

Use Cases

• Checking whether a received JWT has expired, as a first step when investigating an authentication bug
• Verifying that an issued JWT is correctly signed with the expected Secret
• Determining whether an API error (such as 401) is caused by a signature mismatch or an expired token

FAQ

Notes

• If you don't enter a Secret, the signature is not verified and "Not verified" is displayed. Leave Secret empty if only inspecting the contents is enough.
• The "Standard JWT (jwt.io example)" sample validates as a valid signature when you enter "your-256-bit-secret" as the Secret — useful for trying out the feature.
• A JWT without an exp claim cannot have its expiration determined, so "-" is displayed.