JWT Verifier

Verify JWT signatures (HS256/384/512) and check expiry locally.

About this tool

Verify JWT signatures (HS256/384/512) and check expiry locally. Handy for auth debugging, test fixtures, and moving data between transport formats like Base64, URL encoding, and tokens.

Enter the same test Secret key used to sign the token. Paste the JWT into the JWT token editor. Example — Verify an HS256 token with a test secret: try `Secret: test-only-secret Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQyIiwicm9sZSI6ImFkbWluIiwiaWF0Ij…` and expect something like `✓ Signature is VALID { "header": { "typ": "JWT", "alg": "HS256" }, "payload": { "sub": "user_42", "role": "admin", "iat…`. Test secrets only — never paste production signing keys.

Only HS256 / HS384 / HS512; asymmetric algs cannot be verified in this tool. See also: JWT Decoder, JWT Generator, and HMAC Generator. Runs in your browser — nothing you paste gets uploaded.

How to use

Enter the same test Secret key used to sign the token.
Paste the JWT into the JWT token editor.
Click Verify to check the HMAC signature locally.
Read Result for VALID/INVALID, optional expiry notes, and decoded header/payload.

Example

Verify an HS256 token with a test secret

Input

Secret: test-only-secret
Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyXzQyIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzAwMDAwMDAwfQ.JEQ-_rag3sSMZZk5hfFdc34-L6VsMcMIohn1KDFuG-w

Output

✓ Signature is VALID

{
  "header": {
    "typ": "JWT",
    "alg": "HS256"
  },
  "payload": {
    "sub": "user_42",
    "role": "admin",
    "iat": 1700000000
  }
}

Test secrets only — never paste production signing keys.

Limitations

Only HS256 / HS384 / HS512; asymmetric algs cannot be verified in this tool.
A valid signature does not mean the token is authorized for your API — still check claims server-side.
Do not use production keys here; keep verification of live traffic in your backend.

Related guides

How to Verify a JWT Signature

Related tools

JWT Decoder

Decode JWT tokens and inspect header and payload.

JWT Generator

Create and sign HS256/HS384/HS512 JWT tokens locally in your browser.

HMAC Generator

Generate HMAC-SHA256, SHA384, and SHA512 message authentication codes.

Frequently asked questions

Which algorithms can the JWT Verifier check?

HMAC signatures — HS256, HS384, and HS512 — using your shared secret and the Web Crypto API. Asymmetric algorithms (RS/ES/PS) require a public key and are not verified here.

Does a valid signature mean the token is usable?

Not necessarily. The tool also flags expired tokens (exp) and not-before (nbf) windows, but your application should still enforce issuer, audience, and scope claims.

Is the JWT Verifier free?

Yes. No signup or usage limits.

Is my secret sent to a server?

No. Verification runs entirely in your browser. Still, avoid pasting production signing secrets into any browser-based tool.

How do I inspect claims without a secret?

Use the JWT Decoder to read the header and payload without verifying the signature.