Check a JWT for structural problems – section count, Base64URL validity, JSON shape, the required alg field, claim types, expiry and the dangerous alg none case. Structure is not authenticity.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
Structure is not signature
This checks that a token has the shape a JWT should have: three Base64URL segments separated by full stops, a header and payload that parse as JSON, and the registered claims in the forms the specification requires. It does not verify the signature, and that distinction is the whole point.
Worked example
header.payload.signature
{"alg":"HS256","typ":"JWT"} header
{"sub":"123","exp":1735689600} payload
signature: not checked hereWhat only a server can do
Verifying a JWT means recomputing the signature with the issuer’s key and comparing. That requires the key, so it belongs on a server and never in a browser page. A token that is structurally perfect can be entirely forged.
The alg:none trap
The specification permits an algorithm of “none”, and libraries that honoured it accepted unsigned tokens as valid — a well-known vulnerability class. A validator that flags alg:none is telling you about a real risk rather than a formatting nicety.
Anyone can read a JWT
The header and payload are encoded, not encrypted. Never put anything confidential in a payload: passwords, keys or personal data in a JWT are readable by every party that handles the token. Everything here is inspected in your browser and no token is transmitted.
How to use the JWT Structure Validator
- Paste the token you want to check.
- Click "Validate structure".
- Read the report line by line – a tick marks a check that passed, a cross a structural failure, and a warning triangle something suspicious but not invalid.
Frequently asked questions
What does this check that the decoder does not?
The decoder shows you the contents; the validator tests them against the specification. It checks the section count, Base64URL validity, JSON well-formedness, the presence and value of alg, the types of the time claims, expiry and not-before status, and the consistency of exp against iat.
Does a clean report mean the token is trustworthy?
No. It means the token is well-formed. A structurally perfect token can still be forged, because forging one requires nothing more than writing JSON and Base64URL-encoding it. Trust comes only from signature verification with the correct key.
Why is a missing exp claim flagged?
Because a token without an expiry is valid forever. If it leaks, it can be replayed indefinitely, and revoking it usually means rotating the signing key for everyone. Short lifetimes limit the damage of a leak.
What does it mean when exp is earlier than iat?
That the token expired before it was issued, which is always a bug – typically a unit error where milliseconds were used instead of seconds, or a clock problem on the issuing server.
Inspect a JSON Web Token
A readable view of a token's header and payload, and confidence that its structure is valid.
- JWT DecoderSplit the token and decode the header and payload.
- JWT Structure Validator you are hereCheck the parts are shaped the way a JWT should be.
- JSON FormatterRead the decoded payload with proper indentation.
