Encrypt Online
Theme

JWT Verify & Build

Check signatures against an expected algorithm, inspect selected claims, and build tokens

Verify JWTCheck a signature against an expected algorithm and selected claims
Mode:
Guided mode highlights the fields you need for this check.
Paste the full token (header.payload.signature).
Use this when the token is signed but verification fails.
Checklist
  • Confirm the algorithm matches the header.
  • Verify you selected the correct key source.
  • Make sure the key is the public key for RS256/ES256.
Choose this from trusted issuer or application configuration, not from the token header.
HS256 uses a shared secret. RS256/ES256 use a public key.
Build & Sign JWTCreate a JSON Web Token by entering header and payload JSON, then sign it.
JWK/JWKS to PEMConvert JWK or JWKS JSON into PEM for verification.
JWTVerify
What Is JWT Verification?

JWT verification checks whether a supplied key validates the token signature under the expected algorithm. This validator supports HS256, RS256, and ES256; checks numeric exp, nbf, and iat claims when present; and compares iss and aud when you provide expected values. Get the verification key from the expected issuer and set the issuer and audience your application accepts.

How to Verify a JWT
  1. Paste your token and select the correct algorithm.
  2. Provide a shared secret or public key (PEM/JWK/JWKS).
  3. Optionally set issuer and audience checks.
  4. Click Verify JWT to validate the signature and claims.
Example

Use a known test token and secret to confirm your signing flow. If the signature fails, compare the algorithm, key source, and claims to the expected values from your identity provider.

Common JWT Verification Pitfalls
  • Algorithm mismatch between the header and the selected algorithm.
  • Selecting an algorithm from untrusted token data instead of trusted application or issuer configuration.
  • Using a shared secret for RS256/ES256 (these require a public key).
  • Clock skew too strict for exp or nbf validation.
Do This Locally (CLI)
# Verify HS256 with jsonwebtoken
npm install jsonwebtoken
node -e "const jwt=require('jsonwebtoken'); console.log(jwt.verify(process.env.TOKEN, process.env.SECRET));"
FAQ
Does this tool verify signatures?

Yes. It validates the signature and optional claims.

Can I use JWKS?

Yes. Enter an HTTPS JWKS URL and select the key by kid. Fetching makes a direct request from your browser to that host.

What does a passing result mean?

The signature matches the supplied key and algorithm, and the displayed claim checks passed. You still need a key from the expected issuer and application rules that decide what access the token allows.

Token and key inputs are processed in this browser tab.