Check a JWT for structural problems – section count, Base64URL validity, JSON shape, the required alg field, claim types, expiry and the dangerous alg none case. Structure is not authenticity.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the JWT Structure Validator
- Paste the token you want to check.
- Click "Validate structure".
- Read the report line by line – a tick marks a check that passed, a cross a structural failure, and a warning triangle something suspicious but not invalid.
Frequently asked questions
What does this check that the decoder does not?
The decoder shows you the contents; the validator tests them against the specification. It checks the section count, Base64URL validity, JSON well-formedness, the presence and value of alg, the types of the time claims, expiry and not-before status, and the consistency of exp against iat.
Does a clean report mean the token is trustworthy?
No. It means the token is well-formed. A structurally perfect token can still be forged, because forging one requires nothing more than writing JSON and Base64URL-encoding it. Trust comes only from signature verification with the correct key.
Why is a missing exp claim flagged?
Because a token without an expiry is valid forever. If it leaks, it can be replayed indefinitely, and revoking it usually means rotating the signing key for everyone. Short lifetimes limit the damage of a leak.
What does it mean when exp is earlier than iat?
That the token expired before it was issued, which is always a bug – typically a unit error where milliseconds were used instead of seconds, or a clock problem on the issuing server.
