JWT Verify

Verify and decode JSON Web Tokens (JWT) to validate signatures and extract payload information.

Overview

JWT Verify lets you paste any JSON Web Token and instantly validate its HMAC signature (HS256, HS384, or HS512) against your secret key, check whether the token has expired, and inspect the decoded header and payload claims — all without sending your token or secret to any server. Because the cryptographic verification runs entirely inside your browser using the Web Crypto API, sensitive tokens and keys never leave your device. This makes it safe to debug authentication issues in development or audit tokens in controlled environments without trusting a third-party service with your credentials.

Common Use Cases

  • Debug Auth Failures — Developers paste a failing token to pinpoint whether the problem is a wrong secret, an expired claim, or a tampered payload.
  • Inspect Token Claims — Backend engineers decode the header and payload to verify custom claims, issued-at timestamps, and issuer fields without writing throwaway code.
  • Validate Test Tokens — QA teams confirm that tokens generated by a staging environment carry the correct algorithm and claim structure before shipping.
  • Security Audits — Security reviewers check that tokens use strong HMAC variants (HS256+) and that expiration claims are set appropriately.
  • Learn JWT Structure — Students and new developers inspect real tokens to understand the three-part header.payload.signature format hands-on.

How It Works
1

Input JWT Token

Paste the JWT token you want to verify and decode. The token should be in the standard three-part format.

2

Provide Verification Key

Enter the secret key (for HMAC) or public key (for RSA) used to verify the token's signature.

3

Verify and Decode

The tool validates the signature, checks expiration, and displays the decoded header and payload information.

Frequently Asked Questions

What does JWT verification check?
JWT verification checks the cryptographic signature to ensure the token hasn't been tampered with, validates the expiration time, and decodes the payload to show the claims.

Why is my JWT verification failing?
Common reasons include: wrong secret/public key, expired token, modified token content, or algorithm mismatch. Check that you're using the correct key and algorithm.

Can I decode a JWT without verifying it?
Yes, the tool can decode the header and payload even without verification keys, but this won't validate the signature or ensure the token's authenticity.

Is it safe to verify JWTs in the browser?
Yes, all verification happens locally. However, be cautious with secret keys - only use this tool with test tokens or in secure environments.

What information is in a JWT payload?
JWT payloads typically contain claims like user ID (sub), expiration time (exp), issued time (iat), issuer (iss), and any custom claims specific to your application.

Related Tools

AES File & Text Encryptor Base64 Decode Base64 Encode CSR Generator DER to PEM Converter Hash Generator