What is JWT Verifier?
JWT Verifier validates the signatures of JSON Web Tokens (JWTs) to ensure they haven't been tampered with. Unlike the JWT Debugger which only decodes tokens, JWT Verifier performs cryptographic verification using your secret (for HS256) or public key (for RS256/ES256). This is essential for debugging authentication flows and validating token integrity.
Why Use This Tool?
When debugging authentication issues, you need to verify if tokens are correctly signed. Common scenarios include: testing newly issued tokens, debugging "invalid signature" errors, validating tokens from third-party providers, and ensuring key configuration is correct. JWT Verifier performs this verification entirely in your browser - your secrets and tokens never leave your device.
How to Use JWT Verifier
- Paste the complete JWT token
- Select the algorithm used (HS256, RS256, ES256, etc.)
- Enter the secret (for HMAC) or public key (for RSA/ECDSA)
- Click "Verify" to check the signature
- View decoded header and payload alongside verification result
- Check expiration and other claims automatically
Features
- HMAC algorithms: HS256, HS384, HS512
- RSA algorithms: RS256, RS384, RS512, PS256, PS384, PS512
- ECDSA algorithms: ES256, ES384, ES512
- Complete signature verification using Web Crypto API
- Automatic expiration checking (exp claim)
- Not-before validation (nbf claim)
- Issuer and audience claim inspection
- PEM key format support
Common Use Cases
- Authentication Debugging: Verify tokens are correctly signed
- Key Rotation: Confirm new keys sign tokens correctly
- Third-Party Integration: Validate tokens from OAuth providers
- Security Audits: Verify token signing configuration
- Development Testing: Test token generation before deployment
Tips & Best Practices
- ✓ For RS256, you only need the public key to verify - never share private keys
- ✓ HS256 secrets should be at least 256 bits (32 characters) for security
- ✓ Check kid (Key ID) header claim when using JWKS with multiple keys
- ✓ Expired tokens (exp claim) will show as invalid signature
How It Compares to Alternatives
jwt.io allows signature verification but sends tokens to Auth0's servers. JWT Verifier performs all cryptographic operations locally using the Web Crypto API. Unlike library-based verification, it provides a visual interface for debugging.
Frequently Asked Questions
Can I verify JWT signatures locally?
Yes. JWT Verifier checks signatures and claims in your browser without uploads.
Which algorithms are supported?
It focuses on HS256 verification with clear claim validation results.
Ready to Get Started?
Use JWT Verifier for free - no registration required.
Launch JWT Verifier