JWT Signature Verifier
Decode a JSON Web Token and verify its HMAC signature against a secret. This tool shows the header and payload, checks the signature with the browser crypto API, and flags expired or not-yet-valid tokens.
JWTs are URL-safe Base64 inside, so the URL-Safe Base64 tool shows the raw segments, while the JWT Decoder reads one without checking the signature.
How to use the JWT Verifier
- 1 Paste the JWT you want to inspect.
- 2 Enter the secret used to sign it, for an HS256 token.
- 3 Verify the signature and read the decoded header and payload claims.
- 4 Check the exp claim to confirm the token has not expired.
How to Use
Paste a JWT and your HMAC secret. The tool decodes both segments and verifies the signature. Expiry and issued-at claims are checked against the current time.
- Decodes header and payload instantly
- Verifies HS256, HS384, and HS512 signatures
- Checks exp, nbf, and iat claims
- Verifies base64url encoding integrity
- Your secret and token never leave the page
Frequently asked questions
Is the payload of a JWT secret?
No. The payload is Base64url-encoded, not encrypted, so anyone holding the token can read every claim. A JWT guarantees integrity — that nobody altered it — but not confidentiality. Never put sensitive data in one.
What is the alg:none vulnerability?
An attack where the header is changed to "alg": "none" and the signature removed. If a server trusts the header instead of enforcing its own expected algorithm, it accepts the forged token. Always pin the algorithm on the server side.
What is the difference between HS256 and RS256?
HS256 uses one shared secret for both signing and verifying, so every party that can verify can also forge. RS256 uses a private key to sign and a public key to verify, so a service can check tokens without being able to mint them — which is why it is preferred for third parties.
Related Security & Cryptography Tools
You might also need
Tools from other categories that people pair with the JWT Verifier: