JWT Signature Verifier

The secret is used as typed

The secret field is read as UTF-8 text, character for character. A trailing space or newline copied with it makes a valid token fail. Some platforms display the HMAC key Base64-encoded; if verification fails with a key you know is right, that encoding is the usual cause, and a key whose raw bytes are not text cannot be entered here.

RFC 7518 requires an HMAC key at least as long as the hash output, 32 bytes for HS256, so short secrets like secret are fine for testing only.

What a valid result does not tell you

The check covers the signature only. A token that expired last year still shows as valid, so compare its exp claim with the current time on the Unix timestamp page, and check iss and aud against what your service expects.

Tokens signed with RS256, ES256, or another public-key algorithm are not verified here. They need the issuer's public key, which identity providers usually publish as a JSON Web Key Set; the JWT decoder still reads their claims.

How to use it

1. Paste a Base64-encoded JWT token string.
2. Enter your HMAC secret key.
3. Review the decoded header, payload, and live signature verification badge.

Privacy & limitations

Tokens and secret keys are processed purely in client memory and are never transmitted over the network.