Encoding

JWT Verifier

Check a JWT’s signature and its expiry, audience and issuer — not just decode it.

JWT

Settings

Output

Result appears here after you select

{ } How to use

  1. Paste the token.
  2. Enter the shared secret if it is signed with HS256, HS384 or HS512.
  3. Select Process. Each check is reported separately, with the header and payload below.

{ } How it works

JWT Verifier works on the text you provide. Adjust the options, then select Process ▸ and it runs entirely in your browser — nothing is uploaded to a server — then shows the result in the Output panel.

Inputs

  • JWT — paste or type your input in the left panel (use Sample for an example)
  • Shared secret (HMAC) — a value
  • Expected audience (optional) — a value
  • Expected issuer (optional) — a value
  • Clock leeway (seconds) — a value (default: "0")

Output

TXT text — copy or download it from the Output panel.

{ } Common uses

  • Find out whether a token a client sent is genuine, or just well-formed.
  • Work out why an API is rejecting a token that looks correct.
  • Confirm a token is meant for your service and not another one.
  • Check whether a token has expired, and by how long.

{ } Limitations

  • HMAC only — HS256, HS384 and HS512. RS256 and ES256 need the issuer’s public key, which is normally served from a JWKS endpoint on another origin; a browser cannot read that response, so those are reported as unverified rather than passed.
  • Without a secret, the signature is not checked and the result says so. Claims that look fine on an unverified token prove nothing, because anyone can write one.
  • It checks the token. It cannot tell you whether the token was revoked, since that lives in the issuer’s records rather than in the token.

{ } FAQ

Is my data uploaded to a server?

No. Everything runs locally in your browser — your files never leave your device.

Can I process more than one file at once?

This tool works on one input at a time.

Is this tool free?

Yes — it’s completely free and needs no sign-up.

Why is decoding a JWT not enough?

Because a JWT is only base64 — anyone can write one claiming to be anyone, and a decoder will happily show you their claims. The signature is the only part that says the issuer wrote it. Reading a token without checking the signature tells you what its bearer wanted you to believe.

What is the "none" algorithm and why does it fail here?

It is a real algorithm in the specification meaning no signature, and a real attack: take a valid token, rewrite the payload, set alg to none, drop the signature. A verifier that honours it accepts anything. It is reported as a failure regardless of everything else.

Is my secret sent anywhere?

No. The signature is checked in your browser with the Web Crypto API. That is exactly why this can ask for a secret at all — you should never paste a signing secret into a site that checks it on a server.

Why can it not verify my RS256 token?

RSA and ECDSA verification needs the issuer’s public key, which is normally fetched from a JWKS URL. A browser cannot read a response from another origin, so the key cannot be retrieved here. It is marked unverified rather than quietly passed.