JWT Signature Verifier
Fast, accurate, and free online JWT Signature Verifier tool that runs directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
Rate this tool:
Related tools
Other tools you may find usefulJWT Signature Verifier – HMAC and RSA verification in browser
JWT signature verification is a key security step. The tool verifies the JWT token signature for the HS256 (HMAC-SHA256) and RS256 (RSA-SHA256) algorithms directly in the browser - without sending the token to an external server, which is safe for production tokens.
How JWT verification works
JWT = header.payload.signature. Header + payload: base64url encoded. Signature: HMAC-SHA256(base64url(header) + "." + base64url(payload), secret) for HS256. Verification: calculate local signature → compare with signature in token. Result: valid (signatures match) or invalid (changed token or incorrect key).
JWT Signature Algorithms
HS256 (HMAC-SHA256): Symmetric Secret Key. The server signs and verifies with the same key. Simple, but the key must be protected. RS256 (RSA-SHA256): asymmetric. Private key signs, public key verifies. Safer in distributed systems. ES256 (ECDSA-SHA256): elliptical curve, smaller keys. Avoid "none" (no signature - vulnerability!).
RS256 Verification – Public Key
RS256: you need public key for verification. Format: PEM (-----BEGIN PUBLIC KEY-----). JWKS: JSON Web Key Set (server endpoint with public keys). Auto download: well-known/jwks.json. Tool: Paste public key PEM or JWKS URL. Verification: Web Crypto API (SubtleCrypto.verify()) – native, safe in the browser.
Claims to check
exp (expiration): whether the token has not expired. iat (issued at): whether the token is from the future. nbf (not before): whether it is already valid. iss (issuer): whether from the expected server. aud (audience): whether for your application. sub (subject): user ID. jti (JWT ID): whether the token is not blacklisted.
FAQ
How to securely validate JWT in Node.js?
npm install jsonwebtoken. const jwt = require("jsonwebtoken"). jwt.verify(token, secret, (err, decoded) => { if(err) throw err; console.log(decoded); }). Options: algorithms: ["HS256"] (whitelist, prevents alg confusion). audience: "myapp". issuer: "https://auth.example.com". clockTolerance: 30 (seconds).
How to verify JWT with JWKS (RS256)?
npm install jwks-rsa jsonwebtoken. const jwksClient = require("jwks-rsa"); const client = jwksClient({ jwksUri: "https://auth.example.com/.well-known/jwks.json" }). Get public key by kid (key ID) from token header. Verify with jwt.verify(token, key.publicKey). JWKS Caching: jwks-rsa does this automatically.
Common JWT verification errors?
Algorithm confusion: server accepts "none" or RS256 changed to HS256 with public key as secret → critical vulnerability. Fix: always explicitly specify algorithms: ["RS256"]. Expired token: check exp. Key rotation: if the key has changed, the old tokens become invalid. Audience mismatch: token for another app - check aud.
Can I trust online JWT verification tools?
NO for production tokens with real data. Risk: the token contains a payload with user data. Secure: This tool verifies in the browser (JavaScript), without sending to the server. Check: whether the tool is open-source or uses network requests. Developer Test Tokens: Secure. Production: use locally (node-jose, python-jose).
What is an "alg:none" attack on JWT?
Vulnerability: if the server accepts a JWT with "alg":"none" in the header - anyone can create a valid token without a signature. Attack example: change header to {"alg":"none","type":"JWT"}, remove signature, add {admin:true} in payload. Fix: always check the algorithm in the server code. Never trust the algorithm declared in the token – whitelist.
Related tools: JWT parser, base64 encoder and API key generator.