JWT, Base64 and hashes in brief
A JSON Web Token (JWT) is a signed ID card in text form. APIs, single sign-on and OAuth use it to prove who is making a request. When you have a token in front of you, you usually want to know what is inside, whether it is still valid and whether the signature is right.
Structure of a JWT
A JWT has three Base64URL-encoded parts separated by dots: the header (algorithm and key ID), the payload (claims such as sub, exp or aud) and the signature. Header and payload are only encoded, not encrypted. Anyone who sees the token can read them. Confidential data needs an encrypted token (JWE).
Verifying the signature
- HS256, HS384, HS512: issuer and recipient share a secret. Whoever knows it can also issue tokens.
- RS256, PS256: RSA signature. It is checked with the public key, which identity providers usually publish as JWKS at
/.well-known/jwks.json. - ES256, ES384, ES512: ECDSA with the curves P-256, P-384 and P-521. Shorter keys, same security.
- EdDSA: Ed25519, fast and robust against implementation mistakes.
A token with alg: none is not signed and must never be accepted. The tool also warns about expired tokens, missing exp, times in milliseconds and headers that bring their own key (jwk, jku).
Base64, Base64URL, hex and URL encoding
Base64 represents any bytes with 64 printable characters and is used for mail attachments, certificates (PEM) and data URIs. Base64URL replaces + and / with - and _ and drops the padding so the result fits into URLs and JWTs. Hex writes each byte as two characters, URL encoding escapes special characters with %. When decoding, the tool detects binary data, formats JSON and recognises common file types.
Checksums and HMAC
Use SHA-256 or SHA-512 to check that a downloaded file is unchanged: paste the vendor’s checksum into the compare field, drop the file, done. MD5 and SHA-1 are considered broken and should only be used to compare with old values. CRC32 detects transmission errors but does not protect against tampering. An HMAC combines the hash with a secret key; webhooks, for example, sign their messages this way.
FAQ
Are my tokens or keys sent anywhere?
No. Decoding, verifying, signing and hashing run in your browser with JavaScript and WebCrypto. Tokens and keys do not end up in the address bar either.
How do I verify a token from Entra ID, Auth0 or Keycloak?
Open the provider’s JWKS address (usually linked as jwks_uri in /.well-known/openid-configuration), copy the JSON and paste it as the key. The tool picks the key with the matching kid.
Why is my HS256 signature invalid although the secret is right?
The secret is often stored Base64-encoded. Switch the secret format to Base64. Also watch out for trailing spaces or line breaks.
Is a JWT encrypted?
A normal JWT (JWS) is only signed. Anyone can read header and payload. Encrypted tokens (JWE) have five parts; the tool only shows their header.
Which checksum should I use?
SHA-256 or SHA-512 for downloads and integrity checks. MD5 and SHA-1 only when a vendor publishes nothing else.