Skip to content
ToolQivo

JWT Verifier

Check a JWT signature against a secret or a public key, and see why it fails.

Developer Tools Reviews Free · no sign-up

Only the public key is needed to verify an RS, PS or ES token. A private key should never be pasted into a web page.

Quick Tool Overview

The JWT Verifier checks a signature against an HMAC secret or an RSA or EC public key, and reports the signature result separately from the expiry check — because a token can be perfectly signed and still unusable.

What it does
Verifies a JWT signature and its time claims
You give it
A token and a secret or PEM public key
You get back
A signature verdict and a claim verdict
Best for
Confirming a token is genuine and still valid
Developer Tools Free, unlimited use No sign-up Runs in your browser

About the JWT Verifier

Decoding a token tells you what it says; verifying tells you whether to believe it. This checks the signature, and separately checks the time claims, because a token can be perfectly signed and still expired — and the two failures need different fixes.

HMAC algorithms take a shared secret. RSA and ECDSA algorithms — RS256, PS256, ES256 and their larger siblings — take the public key in PEM form, which is safe to paste because it is public by definition. When verification fails the message says which thing failed: a signature that does not match, a key in the wrong format, an algorithm the token declares but the key cannot support, or simply an expired token.

Key features of the JWT Verifier

Symmetric and asymmetric

HS256 through HS512 with a shared secret, and RS, PS and ES algorithms with a PEM public key.

Two verdicts, not one

Signature validity and claim validity are reported separately, because they fail for different reasons and need different fixes.

Specific failure messages

A wrong secret, a key in the wrong format and an algorithm mismatch each produce their own message rather than a generic failure.

Constant-time comparison

The HMAC comparison does not short-circuit on the first differing byte, out of habit rather than necessity.

Keys stay local

Verification uses the browser’s own crypto; nothing is transmitted.

How to use the JWT Verifier

  1. 1

    Paste the token

    The algorithm is read from the header, so the right key type is expected automatically.

  2. 2

    Provide the key

    A shared secret for HS algorithms, or a PEM public key for RS, PS and ES.

  3. 3

    Read the verdict

    Signature valid or not, stated separately from the expiry check.

  4. 4

    Check the claims

    exp and nbf are evaluated against the current time and reported in plain English.

Frequently asked questions

The public key, in SPKI PEM form — the block beginning "-----BEGIN PUBLIC KEY-----". The private key is never needed to verify, and should never be pasted anywhere.

Reviews of the JWT Verifier

What people who use the JWT Verifier think of it. Reviews come from visitors and are posted as written.

No ratings yet

Yours would be the first.

  • 5 0 reviews rated 5 stars
  • 4 0 reviews rated 4 stars
  • 3 0 reviews rated 3 stars
  • 2 0 reviews rated 2 stars
  • 1 0 reviews rated 1 star

Write a review

Used this tool? Your rating helps the next person decide.

Your rating

Plain text only — links, email addresses and HTML are not accepted. Your name and review are shown publicly; nothing else is collected. See the privacy policy.

0 reviews

Newest first

No reviews yet

Be the first to rate the JWT Verifier. It takes half a minute and no account.

Write the first review

More developer tools