Verify JWT Signature Online (HS256/384/512)
Verify a JWT signature (HS256/384/512) with a secret and view header and payload, in your browser.
Local HMAC verification (Web Crypto). Your secret never leaves the browser.
🔒 100% client-side — no data sent
Verify the signature of a JSON Web Token (HS256, HS384 or HS512) using your secret, then decode the header and payload. Everything runs 100% in your browser: your token and secret never leave your machine.
What is it for?
- ▸ Confirm a JWT received from an API is signed with the correct secret
- ▸ Debug an authentication error by inspecting the payload claims
- ▸ Check the expiration date (exp) and issuer (iss) of a token
- ▸ Review the signing algorithm declared in the header
FAQ
How do I verify a JWT signature?
Paste the token, then enter the shared secret used to sign it. The tool recomputes the signature with the declared HMAC algorithm (HS256, HS384 or HS512) and compares it to the token's signature: if they match, the signature is valid.
What is the difference between HS256, HS384 and HS512?
They are three HMAC variants based on the SHA-256, SHA-384 and SHA-512 hash functions respectively. HS512 produces a longer, theoretically stronger signature, but all three rely on the same shared secret.
Is it safe to paste my JWT secret into this tool?
Yes. Verification runs entirely in your browser in JavaScript: neither the token nor the secret is sent to a server. No data is stored or transmitted.