JWT Signature Verifier
Paste a JWT and your signing secret or public key to verify its signature. Supports HS256/384/512, RS256/384/512, ES256/384/512, PS256, and EdDSA — all verified locally.
100% in-browser — nothing uploadedEncoded JWT
Decoded Header
Paste a token to decode this segment.
Decoded Payload
Paste a token to decode this segment.
Verify Signature
Features
100% private
Your token is decoded entirely in your browser. Nothing is uploaded, logged, or sent to any server or API.
Instant decoding
Paste a JWT and the header, payload, and claims are decoded in real time — no button required.
Human-readable claims
Standard claims like exp, iat, and nbf are explained and shown as readable dates with expiry status.
Signature verification
Verify HS256/384/512 with a secret, or RS, PS, and ES algorithms with a public key — all client-side.
How JWT signature verification works
JWT signature verification is the process of confirming that a token was issued by the expected party and has not been modified since issuance. The signature is computed over the Base64Url-encoded header and payload joined by a dot. Verification re-computes the expected signature from the key and compares it to the signature in the token — if they match, the token is authentic and unmodified.
The verification algorithm is specified in the JWT header's alg claim: HMAC (HS256/384/512) uses a shared secret for both signing and verifying; RSA (RS256/384/512, PS256) and ECDSA (ES256/384/512) use a key pair — sign with the private key, verify with the public key; EdDSA uses an Ed25519 key pair. Always check the alg claim against your allowlist of accepted algorithms before verifying.
Paste your JWT in the decoder above and switch to the Signature tab. Select the algorithm, enter your shared secret (for HMAC) or the public key PEM/JWK (for asymmetric algorithms), and the tool will verify using the browser's Web Crypto API. Nothing is transmitted to any server.
Verification key by algorithm
- HS256 / HS384 / HS512
- Shared HMAC secret (same key used to sign).
- RS256 / RS384 / RS512
- RSA public key (PEM or JWK, kty: RSA).
- PS256 / PS384 / PS512
- RSA public key (PEM or JWK, kty: RSA) — PSS padding.
- ES256 / ES384 / ES512
- EC public key (PEM or JWK, kty: EC).
- EdDSA (Ed25519)
- OKP public key (PEM or JWK, kty: OKP, crv: Ed25519).
- none
- No signature — must be explicitly allowed and never trusted in production.
How to decode a JWT token online
Paste your token
Copy a JSON Web Token and paste it into the encoded box. You can also load the example token to try it out.
Read the decoded data
The header and payload are decoded instantly. Switch to the Claims tab for plain-English explanations and expiry status.
Verify the signature
Enter the secret (HMAC) or public key (RSA/ECDSA) to confirm the token is authentic and hasn't been tampered with.