For HMAC algorithms like HS256, HS384, and HS512, the cryptographic signature is computed by hashing the Base64URL-encoded header and payload with a shared secret key using the Web Cryptography API (SubtleCrypto.verify). The browser calculates the HMAC digest locally in microseconds and compares it against the third segment of the token using constant-time comparison.

No. The entire decoding, signature verification, and claims analysis processes run 100% client-side in your local browser sandbox. No tokens, secret keys, passwords, or claims data are ever transmitted to any backend server or stored in any remote datastore.

An 'alg: none' token specifies the unsecured JWT profile from RFC 7519 Section 6. In vulnerable backend libraries (CVE-2015-9235), attackers could strip the signature and set alg to 'none', tricking the server into accepting forged claims. Our studio flags 'alg: none' tokens with a high-visibility warning banner so you can audit authentication safety.

These are standard RFC 7519 registered claims expressed in seconds since the Unix Epoch (1970-01-01T00:00:00Z): 'exp' (Expiration Time) marks when the token becomes invalid; 'nbf' (Not Before) defines the earliest timestamp the token may be accepted; and 'iat' (Issued At) records token issuance time.

Standard Base64 uses '+' and '/' characters with '=' padding, which require URL encoding when passed in HTTP query strings or headers. Base64URL (RFC 4648 Section 5) replaces '+' with '-' (hyphen) and '/' with '_' (underscore), and omits trailing '=' padding to make tokens URL-safe and compact.

Yes. You can paste raw HTTP Authorization headers directly. Use our 1-click 'Strip Bearer' quick action button above the editor, or use the Alt+B keyboard shortcut to immediately strip 'Bearer ', surrounding quotation marks, and extraneous whitespace.

Currently, signature verification is optimized for HMAC symmetric algorithms (HS256) where you provide the shared secret. For asymmetric algorithms like RS256 (RSA) or ES256 (ECDSA), verifying signatures requires the public key (typically distributed via JWKS endpoints). You can still decode and inspect all headers and claims for any asymmetric token.

Switch to 'Builder Mode' using the toggle or Alt+M. You can edit header attributes, customize payload claims as raw JSON, enter a secret key, and the studio instantly generates a cryptographically signed, compliant JWT token ready for your test suite or API requests.

Open the Developer API Code Snippets Studio (Alt+S) to view and copy zero-dependency, production-ready verification snippets across 7 programming languages: Node.js (jsonwebtoken), Python (PyJWT), Go (golang-jwt), Rust (jsonwebtoken), Java (JJWT), Bash (OpenSSL + jq), and cURL. You can also download ready-to-run script files (.ts, .py, .go, .rs, .java, .sh) directly with one click.

Press 'Alt+K' or '?' to open the Keyboard Shortcuts Guide. Keybindings include 'Alt+P' for DevToys Smart Clipboard Auto-Detect, 'Alt+V' to toggle 2-Column Split vs Stacked layout density, 'Alt+S' for the API Code Snippets modal, 'Alt+R' to load a random preset scenario, 'Alt+M' to switch between Decoder and Builder studio, 'Alt+C' to copy the RFC 4180 Claims CSV matrix, 'Alt+T' to copy the full token, 'Alt+J' to beautify JSON payload claims, 'Alt+B' to strip Bearer prefixes, '/' to focus the token input area, 'Ctrl+Enter' to verify or copy signed tokens, and 'Escape' to dismiss active dialogs or reset inputs.