JWT Token Verifier

A JWT Token Verifier decodes and verifies JSON Web Tokens (JWT, RFC 7519) — an open standard for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and information exchange in web applications and APIs, typically in OAuth 2.0 and OpenID Connect flows.

A JWT consists of three base64url-encoded parts separated by dots: the Header (containing the signing algorithm and token type), the Payload (containing claims like subject, expiration, and custom data), and the Signature (used to verify the token hasn't been tampered with). The signature is created by signing the encoded header and payload with a secret key (HMAC) or private key (RSA/ECDSA).

This tool automatically decodes the header and payload upon pasting a token, and supports signature verification for HMAC algorithms (HS256, HS384, HS512), RSA algorithms (RS256, RS384, RS512), and ECDSA algorithms (ES256, ES384, ES512) — all using the browser's Web Crypto API.

1. Paste a JWT token — Enter the JWT string in the input area. The header and payload are decoded automatically, displaying the algorithm, type, expiration, and signature status.
2. Review the decoded data — The Header and Payload sections show the decoded JSON. Copy individual parts using the Copy buttons.
3. Enter the verification key — For HS256/384/512, enter the shared secret key. For RS256/384/512 or ES256/384/512, enter the public key in PEM format.
4. Verify the signature — Click Verify Signature to confirm the token's integrity. A valid signature means the token was signed with the correct key and hasn't been tampered with.