JWT Signature Validator
Verify HS256, HS384, and HS512 JWT signatures using your secret key. Everything runs locally: your secret key stays in your browser.
Paste a JWT above to decode it
Your JWTs are decoded locally in your browser, and this tool doesn't send them to our servers.
JWT Validation FAQ
How does JWT signature validation work?
For HMAC-signed tokens (HS256, HS384, HS512), we re-compute the signature using the Web Crypto API with your secret key and compare it to the token's signature. This verifies the token hasn't been tampered with.
Is my secret key safe?
Your secret key stays in your browser. The signature verification is performed entirely client-side using the Web Crypto API.
Which algorithms are supported?
This tool supports HS256, HS384, and HS512 for signature validation. RS256 and ES256 require public key infrastructure that isn't practical in a browser-only tool.
What does "Signature Valid" mean?
It means the signature in the token matches what the secret key would produce. This confirms the token was signed by someone with the secret key and hasn't been modified since.
Need to share secrets securely?
Don't paste API keys or tokens into chat. Use CredenShare to deliver sensitive data with AES-256 encryption and automatic expiration.