Does this verify the signature?

Yes, in the Check the signature panel, for HS, RS, PS and ES algorithms. Paste the shared secret for HMAC tokens or the PEM public key for the rest, and it recomputes the signature over the header and payload exactly as they arrived. That is why editing the payload by even one character flips the answer to a mismatch.

Does a valid signature mean the token is trustworthy?

No. It only means the token was signed by whoever holds the key you pasted. It says nothing about whether that issuer is one you trust, and it does not enforce exp, nbf, aud or iss — those are separate checks your application still has to make.

Why is alg: none refused?

`alg: none` means there is no signature. Anyone could change the claims, so the tool will not call it verified. For real authentication, an application must allow only the algorithms it expects; it must not trust the algorithm just because it appears in the token.

Is it safe to paste a token here?

The decoding and the signature check both happen in your browser and nothing is uploaded. Even so, a token is a live credential — use a throwaway one when you are testing, and never paste a production secret.

JWT Parser

Decode / live edit

JWT

Header

Payload

Signature

Click Header or Payload to edit the JSON. The JWT text updates live; if you edit a signed token, the old signature will no longer match until you sign again below.

Check the signature

Secret or public key

The algorithm is read from the token header. HS256, HS384 and HS512 take the shared secret as UTF-8 text; RS, PS and ES take a BEGIN PUBLIC KEY PEM. A valid signature proves the token was signed by the holder of that key — it does not prove the issuer is one you trust, and it says nothing about exp, aud or iss. Use this to debug a token, not as an authorisation check.

Learn

JWT Parser Guide

About this tool

Decode, live-edit and verify JSON Web Tokens. Paste an existing token to inspect it, click the header or payload to edit the JSON and rebuild the token live, then check whether the signature still matches. Signature checking covers HMAC (HS256/384/512), RSASSA-PKCS1_v1_5 (RS256/384/512), RSA-PSS (PS256/384/512) and ECDSA (ES256/384/512).

Questions

Does this verify the signature?: Yes, in the Check the signature panel, for HS, RS, PS and ES algorithms. Paste the shared secret for HMAC tokens or the PEM public key for the rest, and it recomputes the signature over the header and payload exactly as they arrived. That is why editing the payload by even one character flips the answer to a mismatch.
Does a valid signature mean the token is trustworthy?: No. It only means the token was signed by whoever holds the key you pasted. It says nothing about whether that issuer is one you trust, and it does not enforce exp, nbf, aud or iss — those are separate checks your application still has to make.
Why is alg: none refused?: alg: none means there is no signature. Anyone could change the claims, so the tool will not call it verified. For real authentication, an application must allow only the algorithms it expects; it must not trust the algorithm just because it appears in the token.
Is it safe to paste a token here?: The decoding and the signature check both happen in your browser and nothing is uploaded. Even so, a token is a live credential — use a throwaway one when you are testing, and never paste a production secret.