Carmedin
Decoded Header
Free ToolLIVE
JWT Decoder & Validator.
Decode any JSON Web Token, check it against common risk patterns, and verify its signature for HMAC, RSA, RSA-PSS, and ECDSA algorithms — instantly, entirely in your browser.
Processed locally
Security findings
Signature verification
Decode a token
Client-side onlyUse test or synthetic tokens only. Do not paste real patient data, production credentials, or live authentication tokens.
The "Clean HS256 example" is signed with secret
your-256-bit-secret — paste that into the Verify Signature tab to see a real signature check pass.{}
No token decoded yetPaste a JWT above and click Decode Token to inspect its structure, claims, risk patterns, and signature options.
Everything above runs client-side in your browser. Nothing you paste is sent to any server.
Reference
JWT Signing Algorithms
What each algorithm needs to verify a signature, and where it's typically used.
| Algorithm | Type | Verify With | Typical Use |
|---|---|---|---|
| HS256 / 384 / 512 | Symmetric (HMAC) | Shared secret | Issuer and verifier are the same trusted service |
| RS256 / 384 / 512 | Asymmetric (RSA) | RSA public key (PEM) | Issuer keeps the private key; any service can verify with the public key |
| PS256 / 384 / 512 | Asymmetric (RSA-PSS) | RSA public key (PEM) | Same as RS*, with a more modern probabilistic padding scheme |
| ES256 / 384 / 512 | Asymmetric (ECDSA) | EC public key (PEM) | Same use case as RS*, with smaller keys and signatures |
| none | — | N/A — no signature | Should never appear on a token your server accepts |
Beyond decoding a token
We design the auth and identity systems these tokens come from.
From token lifetimes to key rotation policy, secure-by-default authentication is one piece of a larger security posture. That's what we do.