JWT Verifier
Verify a JWT's HMAC signature with your secret and inspect its claims — checks HS256/384/512 and flags expiry, all locally in your browser.
About the JWT Verifier
This JWT verifier checks whether a token's signature is valid for the secret you provide, and decodes its header and payload for inspection. Paste the token, choose the HMAC algorithm and enter the secret: the tool recomputes the signature with the Web Crypto API and tells you clearly whether it matches.
Beyond the signature, it surfaces the standard time claims — exp, iat and nbf — converted to readable dates, and flags whether the token has expired or isn't yet valid. That answers the two questions that matter most when debugging auth: is this token authentic, and is it still in date?
Everything runs locally; the token and secret never leave your browser. It complements the JWT Decoder, which only reads claims without verifying the signature.
How to Use the JWT Verifier
- 1Paste the JWT into the input box.
- 2Select the HMAC algorithm used to sign it.
- 3Enter the shared secret.
- 4Verify to see the signature result, claims and expiry status.
Frequently Asked Questions
What does signature verification prove?
A valid HMAC signature proves the token was created by someone holding the same secret and hasn't been altered since. If verification passes, you can trust the claims came from your issuer. If it fails, the token was tampered with, signed with a different secret, or uses a different algorithm.
Which algorithms can it verify?
The HMAC family: HS256, HS384 and HS512, which use a shared secret. RSA and ECDSA signatures (RS256, ES256) require the issuer's public key and a different verification path, which this tool doesn't perform. Pick the algorithm named in the token's header.
Does a valid signature mean the token is usable?
Not always — a token can be authentic but expired. That's why the verifier also checks exp and nbf and reports the expiry status separately. A token is only good to use if the signature is valid and it's within its time window.
How is this different from the JWT Decoder?
The decoder only base64url-decodes and shows the header and payload — it can't tell whether the token is genuine. This verifier additionally recomputes the signature with your secret to confirm authenticity. Use the decoder for a quick look, the verifier when trust matters.
Is my token or secret uploaded?
No. Verification runs entirely in your browser via Web Crypto. Neither the token nor the secret is transmitted or stored, so it's safe for real tokens during debugging.