JWT verify
Check a JWT’s signature with a secret, public key, certificate or JWK, and optionally its expiry and start times. Unsigned tokens and HMAC tokens checked against a public key are rejected.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Optional: Expected algorithm, HMAC secret format, Check expiry and start times and more
Run
Processes in this browser; cancel at any time
About this tool
Check that a JSON Web Token (JWT) was signed with the key you expect and has not expired. Use it when an API rejects a token and you need to know whether the signature, the key or the expiry is to blame, or to confirm a token from an identity provider before you trust its claims.
It verifies HS, RS, PS, ES and EdDSA tokens with a shared secret, a PEM public key or certificate, or a JWK. Unsigned tokens (alg “none”) and HS tokens checked against a public key are always refused. Verification runs in your browser: the token and key are not uploaded, and the key is never saved with workflows.
How to use it
- Paste the token into “JWT”, with or without “Bearer ”, and the secret or public key into “Key (not saved with workflows)”. Use example loads the jwt.io sample token and its secret.
- Keep “Expected algorithm” on “From the token header”, or pick the algorithm your server requires. For HS tokens, set the “HMAC secret format”.
- Leave “Check expiry and start times” on, and allow a few seconds of “Clock tolerance” if the clocks differ.
- Select Run. A valid token gives verified.json with the header, the payload and readable times; otherwise the error says what failed.
Formats and limits
- Input
- Text
- Output
- JSON
- Size limit
- 1 MB
- Settings
- Expected algorithm; HMAC secret format (Text, Hex, Base64); Check expiry and start times; Clock tolerance
- Privacy
- Text and keys stay in this browser session and are not uploaded. Keys are an input, so they are never saved with workflows or recipes.
- Price
- Free, no sign-up
Common questions
Why set an expected algorithm?
With “From the token header” the tool uses the alg the token itself names. Choosing the algorithm your server uses makes a token with any other alg fail, as a strict server would.
Which keys are accepted?
HS tokens need the shared secret as text, hex or Base64, or an oct JWK. Other algorithms take a PEM public key, a certificate, a single JWK, or an RSA private key, whose public half is used. For a JWKS, paste the one key object from its keys list that matches the token’s kid.
Why does it say the signature is valid but the token has expired?
The signature matched, but by your device’s clock exp has passed or nbf is still in the future. Add some “Clock tolerance”, or turn off “Check expiry and start times” to check the signature alone.
Does it check the issuer or audience?
No. Only the signature, exp and nbf are checked; iss, aud and other claims appear in the payload for you to compare yourself.
What if the signature does not match the key?
Either the key is not the one that signed the token, or the token was changed. For HS tokens, also check the “HMAC secret format”: a secret meant as Base64 gives a different key when it is read as text.
Related tools
JWT sign
Sign a JSON payload as a JWT with HS, RS, PS, ES or EdDSA algorithms, optionally adding issue and expiry times. Secrets and private keys are a separate input and are never saved with workflows.
JWT decode
Show a JWT’s header, payload and readable issue, start and expiry times without checking the signature.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
HMAC
HMAC of text with a secret key using MD5, SHA-1, SHA-2, SHA-3 or SM3. The key is a separate input and is never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.