JWT Verifier
Verify if a JWT token was signed with a specific secret key
Choose a Tool
Verify if a JWT token was signed with a specific secret key. All processing happens locally in your browser - no data is sent to any server.
How to verify a JWT signature
Paste the token and the secret. The tool recomputes the signature and tells you whether it matches.
- 01
Paste the full token
All three parts, header.payload.signature. A "Bearer " prefix is removed automatically. If the signature part has been cut off, verification will fail.
- 02
Enter the secret exactly as your server uses it
The secret is read as plain UTF-8 text, character for character. A trailing space or newline copied from a .env file counts and will make the check fail.
- 03
Verify and read the result
The tool reads alg from the header, recomputes the HMAC signature with your secret, and compares it byte by byte with the one in the token.
What this verifier checks, and what your server must
A valid signature proves one thing: the header and payload haven't changed since someone holding the secret signed them. It doesn't prove the token is still current or meant for your API. Those checks happen on the claims, and this tool leaves them to you.
| Check | This tool | Your backend should |
|---|---|---|
| Signature matches the secret (HS256, HS384, HS512) | Yes | Yes |
| RS256, ES256 and other public-key signatures | No, shows an error | Yes |
| Token has expired (exp) | No | Yes |
| Token isn't valid yet (nbf) | No | Yes |
| Issuer (iss) and audience (aud) are the expected ones | No | Yes |
| Token has been revoked | No | Only if you keep a deny list |
Why a correct-looking secret fails
Base64 secrets cause the most confusion. Some frameworks store the secret base64-encoded and decode it to raw bytes before signing. If you paste the encoded string here, you're testing a different key. Try the decoded value, or check your library's docs for whether it decodes the secret.
Other causes are smaller. A newline at the end of a secret copied from a file, a token cut short in a log line, or an environment that signs with HS512 while you assumed HS256. The alg in the decoded header tells you which hash was used, so check it first.
When to check a signature by hand
Telling a bad key from a bad token
If the signature checks out here but your API rejects the token, the problem is in the claims or middleware, not the secret.
Checking a token after a key rotation
Verify one token against the old and new secrets to see which key signed it while both are still accepted.
Spotting a tampered payload
If someone edited a role or user ID and re-encoded the payload, the signature won't match. That's the whole point of the signature.