JWT Signature Verifier
Cryptographically verify HMAC-signed JWTs.Security & PrivacyJWT Signature Verifier (HS256)
Cryptographically verify an HMAC-signed JWT with your shared secret — this is real verification, unlike the Decoder tool which only reads claims.
Only HS256/HS384/HS512 tokens can be verified here. RS/ES tokens need public-key crypto.
About this tool
Real verification, not decoding: the signature is recomputed with your shared secret via WebCrypto and compared byte-for-byte. The exp claim is checked too. RSA and ECDSA tokens need public keys and are out of scope.
How to use the JWT Signature Verifier tool
- Paste the token. The full three-part string.
- Enter the shared secret. The same secret that signed the token.
- Verify. A valid signature — and a live exp — are confirmed.
Supported formats
Input
- Plain text or file input
Output
- Converted or analysed output
Inputs are validated before anything is processed. Invalid values and unsupported files are rejected with a clear error instead of failing silently.
Frequently asked questions
How is this different from the JWT Decoder?
The Decoder reads claims without checking anything; this recomputes the HMAC and compares.
Which algorithms are supported?
HS256, HS384 and HS512 only.
Is it safe to paste a real token?
Verification is local; still, prefer short-lived test tokens.
Privacy
Everything you enter stays in this browser tab. There is no upload endpoint for tool inputs, no account, and no server-side copy of your text or files. Results are produced locally and disappear when you close the page.
No account is required and no file is ever uploaded. See the privacy policy for details about analytics and the limited data this site stores.
Known limitations
- RSA and ECDSA signature verification is not offered.
Related tools
Other free tools from the same collection.