JWT Validator
Decode, inspect, and validate JSON Web Tokens (JWT) client-side in seconds.
Inspect and Verify JWTs
Paste your JWT to instantly decode its Header and Payload parts. Verify key claims such as Expiration (exp) and Not Before (nbf), and securely test HS256 signature verification client-side.
Your secret is processed strictly client-side to verify HMAC-SHA256 signatures.
Ready to validate.
Understanding JWT Claims
JSON Web Tokens typically store claims in the payload segment:
iss(Issuer): Identifies who created and issued the token.sub(Subject): Identifies the user or subject of the token.aud(Audience): Specifies the intended recipient of the token.exp(Expiration Time): The Unix timestamp after which the token is invalid.nbf(Not Before Time): The Unix timestamp before which the token must not be accepted.iat(Issued At Time): The Unix timestamp when the token was created.
How to use the validator
- Paste the JWT into the text box. It usually has three parts separated by dots, colored or marked accordingly.
- Enter the HMAC secret in the secret field if verifying an HS256 signature.
- Click Decode & Validate JWT.
- Review the decoded header and payload objects, along with the status check summaries.
