JWT Signature Validator
Verify HS256, HS384, and HS512 JWT signatures using your secret key. Everything runs locally — your secret never leaves your browser.
Paste a JWT above to decode it
Your JWTs are decoded locally in your browser. Nothing is ever sent to any server.
JWT Validation FAQ
How does JWT signature validation work?
For HMAC-signed tokens (HS256, HS384, HS512), we re-compute the signature using the Web Crypto API with your secret key and compare it to the token's signature. This verifies the token hasn't been tampered with.
Is my secret key safe?
Absolutely — your secret key never leaves your browser. The signature verification is performed entirely client-side using the Web Crypto API.
Which algorithms are supported?
This tool supports HS256, HS384, and HS512 for signature validation. RS256 and ES256 require public key infrastructure that isn't practical in a browser-only tool.
What does "Signature Valid" mean?
It means the signature in the token matches what the secret key would produce. This confirms the token was signed by someone with the secret key and hasn't been modified since.
Need to share secrets securely?
Don't paste API keys or tokens into chat. Use CredenShare to deliver sensitive data with AES-256 encryption and automatic expiration.