Press Ctrl + D to bookmark JWT Verifier.
Open your browser menu (⋮ or the share icon) and tap Bookmark or Add to Home Screen.
JWT Verifier
Check a JSON Web Token the way your server should: the signature, the algorithm, and the exp, nbf, iss and aud claims, with one clear verdict.
This is an encrypted token (JWE). It is decrypted, not verified, by its recipient.
Signed with . Read all its claims in the JWT Decoder
Rules · what your server expects
Pin the one algorithm you issue. Accepting several is how algorithm-confusion attacks get in.
-
Signature
-
About the JWT Verifier
The JWT verifier checks a JSON Web Token the way a server should before trusting it: the signature first, then that the algorithm is one you allow, that the token is in date, and that it was issued by and for the right parties.
How to use it
- 1 Paste the token and the secret or public key (PEM, certificate, JWK or JWKS).
- 2 Set your rules: allowed algorithm, expected issuer and audience, clock leeway.
- 3 Read the verdict and fix any check that failed.
Frequently asked questions
Why does signature verification fail?
Usually the key is wrong: a different environment’s secret, extra spaces, or a secret that should be read as Base64. For RS and ES tokens, check that the key’s kid matches the token header. Otherwise the token was changed after it was signed.
Can a token with a valid signature still be rejected?
Yes, and it should be when it has expired (exp), is not valid yet (nbf), comes from another issuer (iss), is meant for another service (aud), or uses an algorithm you do not allow.
What is an algorithm-confusion attack?
An attacker changes alg from RS256 to HS256 and signs the token with your public key as the HMAC secret. A server that trusts the header’s alg may accept it. Pin the one algorithm you issue; this tool also refuses keys that do not match the algorithm.
What is clock leeway?
A few seconds or minutes of tolerance on exp, nbf and iat, because the clocks of the issuer and your server are never exactly in sync. 30 to 60 seconds is common.
Is my secret sent anywhere?
No. Verification uses your browser’s Web Crypto and nothing is sent or saved; only your rules are remembered. Even so, avoid pasting production secrets into any online tool.