JWT Signature Verifier
The JWT Signature Verifier recomputes the HMAC signature of your token with the secret you provide and compares it against the signature attached to the token. A match proves the token was signed with that secret and has not been altered.
What This Tool Does
For HMAC-based algorithms — HS256, HS384 and HS512 — the token signature is produced by hashing the encoded header and payload with a shared secret. This tool performs the same operation locally using the browser Web Crypto API and reports whether the recomputed signature matches the token. The algorithm is read from the token header automatically.
How to Use
- Paste your JWT into the input field.
- Enter the exact secret used to sign the token into the Secret Key field.
- Read the verdict: signature valid (token untampered) or invalid.
- Use Sample Data to try the flow with an example token and secret.
Key Features
- Supports HS256, HS384 and HS512 HMAC algorithms
- Algorithm detected automatically from the token header
- Constant-time style comparison of recomputed vs. attached signature
- Clear valid/invalid verdict with explanatory detail
- Verification performed by the browser Web Crypto API
- Secrets and tokens never leave your device
Common Use Cases
- Confirming a token was signed with the secret you expect
- Detecting tampered or forged tokens while debugging
- Testing your signing configuration end to end
- Validating webhooks or callbacks that use JWT signatures
- Learning how HMAC JWT signing works
HMAC vs. Asymmetric Signatures
HMAC algorithms (HS256/384/512) use one shared secret for signing and verification — anyone who can verify can also sign. Asymmetric algorithms such as RS256 or ES256 sign with a private key and verify with a public key, which suits distributed systems where verifiers must not be able to mint tokens.
This verifier covers the HMAC family. Whichever family you use, pin the expected algorithm during verification so an attacker cannot downgrade to alg "none" or confuse key types.
Frequently Asked Questions
Which algorithms are supported?
HS256, HS384 and HS512 — the HMAC-SHA2 family. Asymmetric algorithms like RS256 require public-key cryptography and are not covered by this tool.
Is my secret safe to enter here?
Verification runs locally via the Web Crypto API; your secret is never transmitted or stored. Avoid entering production secrets on shared or untrusted devices.
Why does verification fail with the correct secret?
The secret must match exactly — including whitespace and encoding. Also confirm the token really uses an HMAC algorithm by checking the alg value in the header.
What does a valid signature prove?
That the header and payload were signed with the entered secret and have not been modified since. You should still validate claims such as exp, iss and aud.
Can a valid-looking token have an invalid signature?
Yes. Anyone can decode and edit the payload, but only the holder of the secret can produce a matching signature — that is the point of verification.
How long should my HMAC secret be?
At least 32 bytes for HS256, 48 for HS384 and 64 for HS512, generated randomly. The JWT Secret Strength Checker can estimate the strength of a candidate secret.
Related JWT Tools
- JWT Secret Strength Checker — Analyze JWT secret strength and security
- JWT Decoder — Decode JWT tokens to view header and payload
- JWT Header Viewer — Display JWT header information only
- JWT Inspector — Comprehensive analysis of JWT token structure and claims