JWT Signature Verifier
Enter your JWT token and secret — the signature will be verified with HS256, HS384 or HS512 HMAC, completely in your browser. The token and secret are never sent anywhere.
Header
Payload
Token checks
How to use
- Paste the JWT token (the three-part one: header.payload.signature).
- Enter the secret key — the same secret that was used when the token was created.
- Click Verify Signature. If the signature matches, you will see VALID, otherwise INVALID.
- Below you will also see the decoded JSON of the header and payload, plus checks for expiry (exp), issued-at (iat) and not-before (nbf).
Privacy: Verification happens in your browser using the WebCrypto API — the token and secret never go to a server. Only HS256, HS384 and HS512 (HMAC) algorithms are supported; RS256/ES256 need a public key, which this tool does not have.
Tips
- Verification needs the exact secret used at signing — even one changed character fails the check.
- A failed verification can also mean the token was altered in transit; never trust an invalid token.
- Test tokens from the jwt.io debugger paste directly here for a quick second opinion.