Put it to work
Inspect exp in a test-server JWT, then verify its signature with your shared secret.
From input to output
- Open JWT debugger and load the example.
- Read the format notes, choose your options, and replace the example with your input. Start with test data instead of sensitive information.
- Run the tool and inspect the result and status. If an error appears, correct the input format and run it again.
- Copy the output or download a file. Generated and converted results are not saved automatically.
A valid signature can still be expired
Sign this payload in generation mode, then verify it with the same key. The signature will be valid, but exp=1 is a time in 1970, so the token is expired. Your application must also check issuer, audience, and authorization. Never blindly trust the algorithm in the token header; constrain it using the verifier’s allowed algorithm.
Example input
{"sub":"user-123","exp":1}Reading the result
Signature: valid exp: expired Issuer / audience: not validated
Details that matter
Format and meaning
Decoding is not authentication. Anyone can read the header and payload.
Using it correctly
HS256, HS384, and HS512 use a UTF-8 shared secret. Use at least 32, 48, or 64 bytes respectively.
Common pitfalls
Signature, exp expiry, and nbf activation are reported separately. Issuer and audience validation are outside this tool’s scope.
Supported scope and limits
100 KB token/JSON limit; HMAC algorithms only
Split inputs that exceed the limit. If a format or algorithm is unsupported, choose a tool that matches your requirements instead of silently changing the format.
What happens to your data?
Tools run in your browser. DNS lookup sends the queried domain to the named external provider. Ads may appear on home, guide, and workspace pages according to settings.
Open tool