JWT Verifier
Runs in your browserPaste a token and the secret it should have been signed with. The HMAC is recomputed locally with WebCrypto.
Result
Paste a token and its secret — the verdict shows up here
How this one works
The signature of an HS256 token is an HMAC-SHA256 of header.payload keyed with the secret. This page recomputes it with the browser’s built-in WebCrypto and compares it to the token’s signature in constant time.
Secrets are read as plain text by default. If yours is stored as Base64 (common with generated keys), switch the encoding — the same characters mean different bytes.
Questions
- Does my secret get sent anywhere?
- No. It’s held in memory in this tab and passed to WebCrypto, which runs in your browser. It isn’t saved to storage either, so closing the tab forgets it.
- Why can’t it verify RS256 tokens?
- RS, ES and PS algorithms use a key pair: the issuer signs with a private key and you verify with their public key (often published as a JWKS). That needs a different input than a shared secret, so it isn’t supported here yet.
- The signature is valid — is the token safe to accept?
- Not by itself. Also check exp and nbf, that iss and aud are what you expect, and that the alg is the one your server requires rather than whatever the token claims.