Verify JWT Signatures Online Validate JWT tokens — verify HMAC signature, check expiration, inspect claims.

The tool works by first splitting the input JWT into its three constituent parts using the `split()` method with a period as the separator. It then decodes the header and payload sections from base64url format to JSON objects using the `atob()` function in conjunction with string replacement operations to handle the differences between base64 and base64url encodings. The decoded header is used to determine the algorithm employed for signing, which is then looked up in a mapping object `aMap` that associates standard HMAC algorithm names like HS256, HS384, and HS512 with their corresponding hash functions from the SHA-2 family, such as SHA-256, SHA-384, and SHA-512.

When a secret is provided, it recomputes the HMAC signature over the concatenated header and payload using the Web Crypto API's `crypto.subtle.sign()` function in conjunction with an imported key derived from the secret via `crypto.subtle.importKey()`. This recompute operation allows for comparison of the generated signature with the one included in the JWT to verify its authenticity. Additionally, it checks if the token has expired by comparing the expiration time claim (`exp`) in the payload against the current system time obtained through `Date.now()`, providing a clear indication of whether the token is still valid or not. The tool utilizes React state management mechanisms like `useState` and event handling callbacks defined with `useCallback` to manage user input, validation results, and any error messages that may arise during the validation process.

The use of specific technologies such as React for building the interface, TypeScript for type safety, and the Web Crypto API for cryptographic operations ensures a secure and reliable validation experience. The support for multiple HMAC algorithms through the `aMap` object makes it adaptable to different security requirements. By performing these checks entirely on the client side without requiring server-side communication, the tool maintains the confidentiality of sensitive information like signing secrets, enhancing its utility in debugging authentication issues where token integrity is paramount.