BYTETOOLS

JWT Signature Verifier

Verify a JSON Web Token's signature with a shared secret or PEM public key, and check its exp, nbf and iat claims against the clock — all in your browser.

Algorithm in header: HS256

Header

{
  "alg": "HS256",
  "typ": "JWT"
}

Payload

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

What is the JWT Signature Verifier?

A JWT verifier recomputes the token's signature over its header and payload using the key you supply. If the result matches the signature in the token, the token is authentic and has not been modified since it was issued.

  • HMAC verification for HS256, HS384 and HS512
  • Public-key verification for RS, PS and ES algorithms
  • Secrets accepted as text, Base64, Base64URL or hex
  • Live exp, nbf and iat checks with a clock-skew allowance
  • Decoded header and payload shown side by side
  • Nothing leaves the browser — safe for real tokens

How to use the JWT Signature Verifier

  1. 1

    Paste the complete JWT, including all three dot-separated parts.

  2. 2

    For an HS-family token, enter the shared secret and pick its encoding.

  3. 3

    For an RS, PS or ES token, paste the matching PEM public key block.

  4. 4

    Set an allowed clock skew if your servers are not perfectly in sync.

  5. 5

    Click Verify signature and read the verdict plus the decoded claims.

About the JWT Signature Verifier

The ByteTools JWT Signature Verifier does what a decoder cannot: it proves whether a token is genuine. Paste the token, supply the HMAC secret or the PEM public key, and the tool recomputes the signature with the Web Crypto API and tells you plainly whether it matches.

It supports HS256, HS384 and HS512 with a shared secret, and RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384 and ES512 with a public key. Alongside the signature result you get a decoded header and payload and a live check of the exp, nbf and iat claims with a configurable clock-skew allowance.

Verification runs entirely in your browser. The token, the secret and the key stay on your device and are never sent to a server — which matters, because a real JWT is a live credential and pasting one into a remote service hands over that credential.

Frequently asked questions

What is the difference between decoding and verifying a JWT?

Decoding just Base64URL-decodes the header and payload, which anyone can do because a JWT is not encrypted. Verifying recomputes the signature with a key and proves the token really came from the issuer and has not been tampered with.

Why does my HS256 token fail to verify?

Nine times out of ten the secret is in the wrong encoding. Many systems store the HMAC key as Base64 or hex rather than plain text, so switch the encoding selector and try again. A trailing newline copied with the secret will also break the match.

What key do I paste for an RS256 token?

The public key, not the private one, in SPKI PEM form — the block that begins with BEGIN PUBLIC KEY. If your identity provider publishes a JWKS instead, you will need to convert the JWK to PEM first, or use the certificate it also exposes.

Is a token with a valid signature always safe to trust?

No. A valid signature only proves authenticity and integrity. You still have to check that the issuer, audience and expiry are what you expect, that the algorithm is the one you require, and that the token has not been revoked on the server side.

What does alg: none mean in a JWT?

It means the token carries no signature at all. It exists in the spec for tokens whose integrity is guaranteed by other means, but accepting it from an untrusted source is a well-known critical vulnerability. This tool refuses to treat it as verified.

Is it safe to paste a real production token here?

Yes. Everything runs in your browser with the Web Crypto API and there is no network request at any point. That is deliberately different from online verifiers that post your token to their server, which effectively leaks a live credential.

Related tools