DevCoreTools

JWT Verifier

Verify JSON Web Token signatures in your browser and inspect decoded claims without uploading your token.

Token and verification key

Decoded contents appear immediately. Trust status requires a successful signature check.

Processed locally in your browser Limit 20,000 token characters. Your input is processed in your browser and is not uploaded or sent to a server. Avoid pasting production secrets, access tokens, private keys, passwords, or sensitive customer data unless you understand the risk.
0 / 20,000 characters0 partsAlgorithm unknown
Use demo secrets or public keys here. Do not paste private keys.
0 / 12,000 charactersRemote JWKS fetching is not used

Decoding is not verification. Only treat a JWT as valid when the signature verifies with the expected key and the required claims pass.

Verification result

Provide a key and run verification before trusting this token.

Decoded, not verified
Signature
Not verified
Claims
Not checked
Algorithm
Unknown
Supported
No
Paste a JWT to begin

The header, payload, signature status, and claim checks will appear here.

What is a JWT Verifier?

A JWT Verifier checks a JSON Web Token signature with a trusted secret or public key, decodes the header and payload, and highlights claim conditions such as expiration, audience, issuer, and activation time.

JWT Decoder vs JWT Verifier

A decoder only turns Base64URL header and payload data into readable JSON. A verifier also checks whether the signature matches the provided key and whether required claims still make the token acceptable.

How JWT signature verification works

The verifier signs or verifies the exact header.payload bytes using the algorithm declared in the JWT header. If the signature bytes do not match, the token may have been changed or the wrong key was provided.

HS256 vs RS256

HS256 uses one shared secret for both signing and verification. RS256 uses an RSA private key to sign and a public key to verify, which is better suited when many services need to validate tokens without holding the signing key.

Common JWT verification failures

  • The token was signed with a different secret or public key.
  • The header declares an unsupported or unexpected algorithm.
  • The token is expired or not active yet.
  • The expected issuer or audience does not match the payload.
  • The token was copied with missing or extra characters.

JWT claim checks and expiration

Signature verification proves integrity for the provided key, but applications still need to enforce claims. Check iss, aud, exp, nbf, and any application-specific permissions before accepting a token.

Security notes for secrets and public keys

This verifier is local and does not fetch JWKS endpoints. Use public keys for RS256 verification when possible, avoid pasting private keys, and keep shared HS256 secrets limited to test data unless your environment allows local handling.

Keep working

View all API & Auth tools
JWT DecoderDecode JWT headers, payloads, claims, and timestamps locally.Base64 Encoder/DecoderEncoding & DecodingEncode and decode Base64 and Base64URL text in your browser.HMAC GeneratorSecurity & CryptoGenerate and verify keyed HMAC signatures locally with common SHA algorithms.Hash GeneratorSecurity & CryptoGenerate text hashes and file checksums locally with common MD5 and SHA algorithms.JSON FormatterJSON ToolsFormat, validate, inspect, and export JSON locally.JSON ValidatorJSON ToolsValidate JSON syntax with clear messages, hints, and formatted output.OpenAPI ValidatorValidate OpenAPI and Swagger specs locally with structured errors and warnings.OpenAPI / Swagger ViewerInspect OpenAPI and Swagger specs locally with endpoints, schemas, and warnings.
Learn more: JWT Guide

Frequently asked questions

Does this JWT Verifier upload my token?

No. Verification runs in your browser with the Web Crypto API. Tokens, keys, claims, and reports are not sent to DevCoreTools.

What is the difference between decoding and verifying a JWT?

Decoding shows the readable header and payload. Verifying checks the cryptographic signature and claim conditions needed before a token can be trusted.

Can I verify HS256 tokens?

Yes. HS256, HS384, and HS512 are supported with a shared secret entered as UTF-8 text.

Can I verify RS256 tokens?

Yes. RS256 verification is supported with a PEM public key in browsers that provide the Web Crypto API.

What does alg none mean?

alg: none means the token is unsecured and has no cryptographic signature. This verifier rejects it as unsupported.

Why is my JWT signature invalid?

The most common causes are the wrong key, a different algorithm than expected, copied token damage, a rotated signing key, or using a private/public key in the wrong format.