Question 1

Can you validate a JWT without the secret key?

Accepted Answer

You can validate the structure of a JWT without the secret key — checking that it has 3 parts, valid JSON in header and payload, required fields like "alg", and whether the exp claim indicates expiration. However, you cannot verify the signature without the secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms). Signature verification confirms the token was not tampered with.

Question 2

How do I check if a JWT is expired?

Accepted Answer

Look at the "exp" claim in the payload. It contains a Unix timestamp (seconds since epoch). Compare it with the current time: if the current Unix timestamp is greater than the exp value, the token has expired. Note that not all JWTs have an exp claim — some are designed to never expire. This validator automatically checks the exp claim for you.

Question 3

What is the difference between JWT validation and JWT verification?

Accepted Answer

JWT validation checks the token format and structure: correct number of parts, valid Base64URL encoding, valid JSON, presence of required fields, and claim values (like expiration). JWT verification goes further by cryptographically checking the signature against the header, payload, and secret/public key. Validation can be done anywhere; verification requires the signing key.

#	Check	What to verify	Requires Key?
1	Structure	Token has exactly 3 dot-separated parts	No
2	Header JSON	First part decodes to valid JSON	No
3	Payload JSON	Second part decodes to valid JSON	No
4	Algorithm	Header contains "alg" field	No
5	Expiration	exp claim vs current time	No
6	Not Before	nbf claim vs current time	No
7	Issuer	iss matches expected issuer	No
8	Audience	aud matches your app	No
9	Signature	Cryptographic signature verification	Yes

Error	Cause	Fix
jwt expired	exp claim is in the past	Refresh the token or extend expiry
jwt malformed	Token does not have 3 parts	Check token format and encoding
invalid signature	Signature does not match	Verify the signing key matches
jwt not active	nbf claim is in the future	Wait until the token becomes active
invalid algorithm	alg does not match expected	Ensure consistent algorithm configuration
invalid audience	aud does not match your app	Check audience claim configuration

JWT Validator

JWT Validation Reference

JWT Validation Checklist

Common JWT Errors

Validation vs Verification

Frequently Asked Questions

Related JWT Tools

More Tools

Recommended

Hold deg oppdatert