β Frequently Asked Questions
Is this JWT Validator secure? Will my secret leak?
Completely secure. All processing happens in your browser β the secret key is never sent to any server.
Which signing algorithms are supported?
HS256, HS384, HS512 (HMAC), RS256/RS384/RS512 (RSA), ES256/ES384/ES512 (ECDSA), and none.
How do I verify a JWT signature?
For HMAC, enter the shared secret. For RSA/ECDSA, enter the public key in PEM format.
What if the JWT is expired?
The tool auto-checks exp and nbf fields, marks expired tokens in red.
Can I decode without verifying the signature?
Yes. Even without a key, the tool decodes Header and Payload JSON for quick inspection.