OneTaskBy Tim King · Updated
JWT Signature Verifier
Verify With an HMAC Secret, PEM Key or JWKS, Plus Algorithm Confusion Checks
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the JWT Signature Verifier works
This JWT signature verifier checks that a JSON Web Token was signed by the key you expect. Paste the token, then the HMAC secret, the issuer's public key or its JWKS, and it reports whether the signature is valid along with the decoded header, payload and expiry times.
What the JWT signature verifier checks
The token's header names the algorithm. HS256, HS384 and HS512 use a shared secret, RS and PS use an RSA public key, ES uses an EC key on the matching curve and EdDSA uses Ed25519. The verifier imports your key with Web Crypto and checks the signature over the header and payload exactly as sent.
A JWKS is searched by the token's kid. The verifier refuses unsigned alg: none tokens and encrypted
JWE tokens, rejects keys of the wrong type for the algorithm, and warns when an HS token is checked
against something that looks like a public key, which is the classic algorithm-confusion attack. The
exp, nbf and iat claims are shown with how long ago or until each one falls. Nothing leaves your
browser, but use test tokens where you can.
FAQ
Where do I get the public key for a token?
Most identity providers publish a JWKS at /.well-known/jwks.json or linked from their OpenID
configuration at /.well-known/openid-configuration. Open it in a browser tab, copy the JSON and paste
the whole set. The verifier picks the key whose kid matches the token header.
Why is my HS256 token invalid with the right secret?
Check whether the secret is stored as plain text, base64 or hex. Some libraries decode a base64 secret before signing, so the same string gives different keys. Switch the encoding setting and try again. Also check for a trailing newline copied with the secret.
Does a valid signature mean the token should be accepted?
No. A valid signature proves who issued the token and that it was not changed. Your server must also
check exp, nbf, the issuer, the audience and any scopes, and it must pin the expected algorithm rather
than trusting the one in the header.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
JWT Decoder
Decode a JWT and read its claims and expiry.
JWKS Inspector
List every key in a JWKS and flag leaks, weak keys and duplicates.
Signature Verifier
Check whether a signature over a message matches a public key.
PEM To JWK Converter
Convert public and private keys between PEM and JWK.
Bearer Token Decoder
Decode an Authorization header and find out what kind of token it is.