JWT.io Debugger does validate at all. Considers ANY secret as valid. How is this possible?

[tyf]

Hey there @suchislife801 !

I believe this answers your question:

Jwt.io debugger always returning signature verified with random using a random key

If you change an HS256 key value on jwt.io the signature component is updated automatically so the signature would be verified as it was just updated. If you want to check the signature of an existing token then first set the key value and only after paste the existing token.