JWT Verify & Build
Validate JWT signatures, claims, and build tokens
Safety note: Avoid pasting production secrets or private keys. All JWT processing stays in your browser.
Verify JWT
Mode:Guided mode highlights the fields you need for this check.
Paste the full token (header.payload.signature).
Use this when the token is signed but verification fails.
Checklist
- Confirm the algorithm matches the header.
- Verify you selected the correct key source.
- Make sure the key is the public key for RS256/ES256.
HS256 uses a shared secret. RS256/ES256 use a public key.
Build & Sign JWT
JWK/JWKS to PEM
JWTVerifyBrowser-only
What Is JWT Verification?
JWT verification checks a token signature to confirm it was issued by the expected signer. This validator supports HS256, RS256, and ES256 and validates common claims like exp, nbf, iss, and aud. Use Guided mode for common failure scenarios or Power mode for full control.
How to Verify a JWT
- Paste your token and select the correct algorithm.
- Provide a shared secret or public key (PEM/JWK/JWKS).
- Optionally set issuer and audience checks.
- Click Verify JWT to validate the signature and claims.
Example
Use a known test token and secret to confirm your signing flow. If the signature fails, compare the algorithm, key source, and claims to the expected values from your identity provider.
Common JWT Verification Pitfalls
- Algorithm mismatch between the header and the selected algorithm.
- Using a shared secret for RS256/ES256 (these require a public key).
- Clock skew too strict for
expornbfvalidation.
Do This Locally (CLI)
# Verify HS256 locally with jsonwebtoken
npm install jsonwebtoken
node -e "const jwt=require('jsonwebtoken'); console.log(jwt.verify(process.env.TOKEN, process.env.SECRET));"FAQ
Does this tool verify signatures?
Yes. It validates the signature and optional claims.
Can I use JWKS?
Yes. Paste a JWKS URL and select the key by kid.
Is the token sent to a server?
No. Verification runs entirely in your browser.