JWT HS256 Signature Verification Explained
HS256 is one of the most common signing algorithms for JSON Web Tokens. It uses a shared secret to sign the token, and the same secret to verify it. That makes verification fast — but it also means you must protect your signing key carefully.
Long-tail intent: If you’re searching for “how to verify JWT HS256 signature,” the key is checking both the signature and the claims (exp, iss, aud) before trusting a token.
How HS256 signing works
JWTs contain three Base64URL-encoded parts: header, payload, and signature. HS256 uses HMAC-SHA256 on the header + payload with a shared secret to generate the signature.
Verification checklist
- Decode header/payload to confirm algorithm and claims.
- Recompute the signature using the same secret.
- Compare signatures securely and reject mismatches.
- Validate
exp,iat, andaudclaims.
Avoid common HS256 mistakes
Never accept alg: none. Ensure you enforce the algorithm server-side, and do not reuse secrets across environments. For JWT decoding, see our full JWT guide.
Verify JWTs Locally
Use JWT Verifier to validate signatures and claims without sending tokens to a server.
Open JWT Verifier →