Encoding and decoding
JWT Signature Verifier
Check a JWT signature locally while keeping the token and key in your browser.
Processed locally. Your input and output are never uploaded.
Tool overview
How JWT Signature Verifier works
JWT Signature Verifier parses a compact JWT and verifies HMAC, RSA, RSA-PSS, or ECDSA signatures using only pasted key material. It keeps input and output separate, runs locally, and documents boundaries instead of making unsupported guarantees.
Signature checks during development
- parses a compact JWT and verifies HMAC, RSA, RSA-PSS, or ECDSA signatures using only pasted key material. for a repeatable local workflow
- Review pasted or locally opened data before copying it
- Prepare output for a related PasteTidy tool
Verify a compact JWT locally
- Paste the source or open a supported local file.
- Choose the documented options and review the separate result.
- Copy or download only after checking the visible output.
Key formats and algorithm handling
- Key format: Secret, PEM public key, or JWK.
- Verification key: Secret, PEM, or JSON JWK used locally.
- Secret encoding: Used only for HMAC secret mode.
Review a verification result
Before
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.c2lnbmF0dXJl
After
{
"valid": false,
"header": {
"alg": "HS256"
},
"payload": {
"sub": "123"
},
"signatureVerified": false,
"warning": "A valid signature does not prove the token is trusted, current, or safe to use."
}A valid signature is not application trust
- A valid signature does not validate issuer, audience, expiry, revocation, or application policy.
- Large input is bounded by the documented local worker limits.
- Input, options, and output are not sent to analytics or placed in URLs.
Browse all encoding and decoding tools โ
Questions
JWT Signature Verifier FAQ
Does JWT Signature Verifier upload my input?
No. Processing stays in the current browser tab or its local Web Worker.
Is the result authoritative?
No. Review the output and the documented limitations before using it in a production workflow.