Security & Cryptography
JWT Verifier
Verify a JWT's HMAC signature and check its claims.
Free foreverRuns in your browserNo sign-up
Verifies HMAC signatures (HS256/384/512) for JWTs. Everything runs in your browser and your token and secret are never uploaded.
About the JWT Verifier
Verify that a JSON Web Token's signature is valid for a given secret, and inspect its header and payload.
It checks HMAC signatures (HS256, HS384, HS512) and flags whether the token has expired.
Everything runs in your browser using the Web Crypto API, so your token and secret are never uploaded.
Key features
- Verifies HS256, HS384 and HS512 signatures
- Shows decoded header and payload
- Flags expired tokens
- Runs entirely in your browser
How to use
- 1Paste the JWT you want to verify.
- 2Enter the HMAC secret it was signed with.
- 3Read whether the signature is valid.
Examples
Valid signature
Input:
token + correct secretOutput:
The signature is valid.The recomputed HMAC matches the token's signature.
Wrong secret
Input:
token + wrong secretOutput:
The signature does not match.Any change to the token or secret fails verification.
Frequently asked questions
- Which algorithms are supported?
- HMAC algorithms HS256, HS384 and HS512. Tokens signed with RSA or ECDSA (RS/ES) can be decoded but not verified here.
- What does an expired result mean?
- The signature can be valid while the token is past its exp time. The tool shows a valid-but-expired warning in that case.
- Is my token uploaded?
- No. Verification runs entirely in your browser.