JWT Signature Verifier
Verify a JSON Web Token's signature with an HMAC secret, PEM public key, X.509 certificate, JWK or JWKS, and check exp, nbf, issuer and audience locally.
HS256Use at least as many random bytes as the hash size (32 bytes for HS256). Short passwords can be brute-forced offline.
What is JWT Verifier?
This tool verifies that a JSON Web Token was signed with the key you provide and has not been modified, and that its time claims are valid now. It accepts a shared secret for HS256/384/512, or a PEM public key, X.509 certificate, JWK or JWKS for RS, PS, ES and EdDSA tokens, with optional issuer and audience checks and clock tolerance.
How to use JWT Verifier
- Paste the token; the algorithm from its header is shown.
- Enter the secret (HS*) or the public key, certificate, JWK or JWKS.
- Optionally set the clock tolerance, expected issuer and expected audience, or tick "Check the signature only".
- Press Verify and read the result; on success the payload and time claims are shown.
Example
The jwt.io sample token (HS256) with secret your-256-bit-secret
✓ Signature verified with HS256 and the time claims are valid.
With the secret wrong-secret the result is: Signature verification failed.
When to use JWT Verifier
Use it to confirm a token was issued by the expected server, debug "invalid signature" errors or test key rotation. Without the correct key no tool can verify a JWT. Avoid pasting production secrets into any website; prefer a public key, which is safe to share.
How JWT Verifier works
Verification runs locally with the jose library and Web Crypto. Only the algorithm named in the token header is allowed, and alg "none" is always rejected. HMAC tokens are verified with the secret's UTF-8 (or Base64-decoded) bytes; asymmetric tokens with an imported SPKI, X.509, JWK or a local JWKS (matched by kid). After the signature, exp and nbf are compared with your device clock (plus tolerance), and iss/aud are compared if you entered them. Each failure is reported with a specific reason.
Common Use Cases
- Check whether a token was signed with the current or the old key after rotation.
- Debug why a gateway rejects tokens (expired vs. wrong audience vs. bad signature).
- Verify an OpenID Connect ID token against the provider's JWKS.
- Confirm a token has not been tampered with.
Security Note
Verification happens in your browser; keys and tokens are not uploaded. Public keys are safe to share, secrets are not.
FAQs
Can it verify a token without the key?
No. A signature can only be checked with the secret (HMAC) or the issuer's public key. Decoding without a key proves nothing.
Where do I get the public key?
OpenID Connect providers publish a JWKS at the jwks_uri listed in /.well-known/openid-configuration. Paste the JSON here.
Why does a valid signature still fail?
The token may be expired, not yet valid (nbf), or have a different issuer or audience than you entered. The message tells you which check failed.