JWT Signature Verifier
Check whether a JSON Web Token signature is valid and whether the token is still within its validity window.
JSON Web Token
Key
What verification actually proves
A valid signature proves two things: the token was issued by someone holding the key, and not a single byte has been altered since. It does not prove the token is still current — check exp separately, which this tool reports alongside the signature result.
- HMAC secret — for HS256, HS384 and HS512.
- Public key (PEM) — an SPKI block beginning "BEGIN PUBLIC KEY", for RS/PS/ES algorithms.
- JWK — the JSON key format returned by most identity providers at their /.well-known/jwks.json endpoint.
Frequently asked questions
Verification fails even though the secret looks right.
The most common causes are a trailing newline in the secret, a secret that is base64-encoded rather than plain text, and an algorithm mismatch between what the header declares and what you expected.
Can I verify with the private key?
Use the public half. This tool asks for a PUBLIC KEY block for asymmetric algorithms; extract it with: openssl rsa -in private.pem -pubout