JWT Verifier
🔒 In your browserVerify a JWT signature with a secret or public key.
A valid signature only proves the token wasn't tampered with — always check exp, iss, and aud too.
🔒 Your token and secret never leave your browser — everything runs locally via the Web Crypto API.
🔒 Private by design: tokens, secrets, and keys are processed entirely in your browser with the Web Crypto API — nothing is sent to a server, stored, or logged. Even so, avoid pasting production secrets into any online tool.
About the JWT Verifier
A JWT is only trustworthy if its signature checks out. This free JWT verifier validates a token's signature using a shared secret (HS256/384/512) or a public key (RS/PS/ES), and reports whether the token is authentic and unexpired.
Verification runs in your browser with the Web Crypto API; nothing is uploaded.
How to verify a JWT
- Paste the token.
- Provide the shared secret for HMAC, or the public key for RSA/ECDSA algorithms.
- See whether the signature is valid and whether the token has expired.
What verifying a token proves
Verifying a JWT checks its signature against the secret (for HMAC) or public key (for RSA/ECDSA). A valid signature proves the token was issued by whoever holds the key and hasn't been tampered with — so you can trust its claims. Decoding alone doesn't do this: anyone can read a JWT's contents, so verification is what makes a token trustworthy.
Frequently asked questions
What does verifying a JWT prove?
It proves the token was signed by whoever holds the secret or private key and hasn't been tampered with — so you can trust its claims.
What do I need to verify a token?
For HMAC algorithms (HS256/384/512) you need the shared secret; for RSA/ECDSA (RS/PS/ES) you need the issuer's public key.
Is my secret or key uploaded?
No. Verification happens entirely in your browser and your secret or key stays on your device.
What do I need to verify a token?
For HMAC algorithms (HS256/384/512) you need the shared secret. For RSA/ECDSA (RS/PS/ES) you need the issuer's public key. Verification runs in your browser and neither is uploaded.
Related searches
Learn more
Related Developer tools
🔗 Embed this tool on your website — free
Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.
<iframe src="https://toolhq.dev/embed/jwt-verifier/" title="JWT Verifier — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>Optional: auto-resize the iframe height
Add this once on the same page so the iframe grows to fit the tool:
<script>
addEventListener("message", function (e) {
if (e.data && e.data.type === "toolshub:resize") {
document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
});
}
});
</script>