JWT Verify

Overview

Paste a JSON Web Token to read its header and payload. You don't need a secret for that. Add the shared secret and the HS256, HS384 or HS512 signature is checked too. Signature and expiry are shown separately, so you can see which one failed. It runs on your browser's Web Crypto, so you can debug with the real token and secret without sending them anywhere.

Find out why auth failsPaste a rejected token and see whether the signature, the expiry, or neither is the problem.
Read claims without a keySee the subject, issuer, issue time and custom claims of a token you have no secret for.
Check staging tokensMake sure tokens from staging have the algorithm and claims you expect before you ship.
Review token hygieneCheck that the header names a real HMAC algorithm, not 'none', and that the expiry is short.
See how a token is builtWatch a token split into header, payload and signature, and see that only the signature needs a key.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.jwt_verify
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Paste the token

The header and payload show up right away, no secret needed.

Add the secret

Enter the shared secret to see whether the signature checks out.

Check expiry

Expiry is shown on its own line, because a validly signed token can still be out of date.

Frequently asked

What does verification actually check?

Two things, shown separately. The signature check recomputes the HMAC with your secret, which tells you if the claims were edited after signing. The expiry check compares the 'exp' claim with the current time.

Why is my verification failing?

Usually the secret is wrong, the token lost a character or picked up a line break when copied, or the service uses a different HMAC algorithm than the one selected. Since expiry has its own line, an expired token still shows whether its signature is good.

Can I decode a token without verifying it?

Yes, that's the default. The header and payload are decoded as soon as you paste, and adding a secret only adds the signature check.

Is it safe to paste a real token here?

The token and secret stay in your browser and are never sent or stored. A valid token is still a credential, though, so mind who can see your screen.

What information is in a JWT payload?

Usually a subject ('sub'), expiry ('exp'), issued-at time ('iat') and issuer ('iss'), plus any custom claims. None of it is encrypted. Base64url is only an encoding, so keep secrets out of tokens.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/