# JWT Inspector & Verifier

Decode a JWT (header + payload) with syntax highlighting, diagnose standard claims, and verify the signature with HS*/RS*/PS*/ES*/EdDSA keys — plus a tampered-token forgery demo

> Canonical page: https://elysiatools.com/en/tools/jwt-inspector-verifier

- **Category:** Security

- **Keywords:** jwt, json web token, jws, decode, verify, signature, hs256, rs256, es256, eddsa, pem, jwk, security

## Overview

Paste a compact JWT (JWS) and the tool will:

1. base64url-decode the header and payload into readable, syntax-highlighted JSON.
2. Run claim diagnostics on exp / nbf / iat / iss / aud / sub / jti, flagging expired, not-yet-valid, or missing claims.
3. Verify the cryptographic signature against a shared secret (HS*) or an asymmetric public key in PEM or JWK form (RS*, PS*, ES*, EdDSA).
4. Optionally re-sign a tampered payload with your key to demonstrate why a verifier MUST pin the expected alg and reject tokens that pass signature checks but were minted by the wrong party.

Security notes:
- Verification happens server-side using Node crypto. The secret/key never leaves the request.
- alg=none tokens are reported and never accepted as valid.
- Always enforce the expected algorithm and issuer/audience on your own backend; this tool is for inspection and education.

## Inputs

- **JWT Token** (textarea): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkphbmUgRG9lZSIsImlhdCI6MTUxNjIzOTAyMn0.yo-bLjjeUhUPia17JiJbc2f1e0JXJIJAi4auivcB-IY
- **Verification Mode** (select)
- **Shared Secret (HS*)** (text): your-256-bit-secret (only for HS256/384/512)
- **Public Key PEM / JWK (RS*/PS*/ES*/EdDSA)** (textarea): -----BEGIN PUBLIC KEY----- ... -----END PUBLIC KEY----- or a JWK JSON object { "kty":"...", ... }
- **Forged Payload** (textarea): {"sub":"attacker","admin":true,"exp":9999999999}
- **Reference Clock Skew (seconds)** (number)

## When to use

- When debugging authentication issues and you need to inspect the header and payload claims of a JWT.
- When verifying if a JWT signature is valid using a shared HS* secret or an asymmetric RS*/PS*/ES*/EdDSA public key.
- When testing how your backend handles clock skew or simulated token forgery attempts.

## How it works

- Paste your compact JWT token into the input field.
- Select your verification mode: decode only, verify signature, or run a forgery demo.
- Provide the shared secret for HS* algorithms, or the public key in PEM or JWK format for RS*, PS*, ES*, or EdDSA algorithms.
- Review the syntax-highlighted JSON payload, claim diagnostics such as expiration status, and the signature verification result.

## Use cases

- Inspecting JWT payload claims to debug user roles, permissions, or expiration times during development.
- Validating token signatures generated by identity providers using their public JWK or PEM keys.
- Simulating token tampering to verify that your application's signature validation logic is secure.

## Frequently asked questions

### Does this tool support asymmetric algorithms like RS256 or ES256?

Yes, you can verify signatures using RS*, PS*, ES*, and EdDSA algorithms by providing the public key in PEM or JWK format.

### Are my secrets and keys safe when using this verifier?

Yes. Verification is performed server-side using Node crypto, and your keys or secrets are never stored or exposed.

### How does the tool handle tokens with the none algorithm?

Tokens using the "none" algorithm are flagged as insecure and are never accepted as valid signatures.

### What is the purpose of the forgery demo mode?

It demonstrates how tampering with a payload and re-signing it behaves, highlighting why backends must strictly enforce expected algorithms.

### Can I account for system clock differences during claim diagnostics?

Yes, you can configure the reference clock skew in seconds to prevent false expiration flags due to minor time differences.

## Related tools

- [JWK Generator & Parser](https://elysiatools.com/en/tools/jwk-generator): Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata
- [WebAuthn Passkey Assertion Decoder & Challenge Debugger](https://elysiatools.com/en/tools/webauthn-passkey-assertion-decoder-challenge-debugger): Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.
- [JWT Decoder](https://elysiatools.com/en/tools/jwt-decoder): Decode JWT tokens
- [Game Save Viewer](https://elysiatools.com/en/tools/game-save-viewer): Drop any game save file — Minecraft NBT, Unreal Engine GVAS, Palworld containers, JSON/XML/INI/Lua text saves, SQLite profiles — and get the detected format, engine versions, key progress fields and a bounded structural tree.
- [Distributed Trace Decoder & Waterfall Visualizer](https://elysiatools.com/en/tools/distributed-trace-decoder-waterfall-visualizer): Decode Jaeger, Zipkin, or OpenTelemetry trace JSON and render span timing, dependencies, and error hotspots as an interactive waterfall report
- [Snowflake / Discord ID Bit Decoder](https://elysiatools.com/en/tools/snowflake-discord-id-bit-decoder): Decode 64-bit Snowflake-style IDs for Discord, Twitter, Mastodon, Sonyflake, Instagram, or a custom bit profile. Extract timestamp, worker/process/machine, sequence fields, align platform epochs, and infer a Discord shard when a shard count is supplied.
- [X.509 Certificate Decoder](https://elysiatools.com/en/tools/certificate-decoder): Parse an X.509 SSL/TLS certificate (paste PEM or upload .pem/.crt) and inspect subject, issuer, validity period with expiry status, public key, signature algorithm, serial, SANs, key usage and fingerprint. Like openssl x509 -text, visualised. Runs locally.
- [BSON Converter](https://elysiatools.com/en/tools/bson-converter): Encode and decode data to/from BSON (Binary JSON) format

## Samples

- [JWT Samples](https://elysiatools.com/en/samples/jwt-samples): Comprehensive JWT examples from basic token structure to advanced security implementations
- [Terraform Plan JSON Samples](https://elysiatools.com/en/samples/terraform-plan-json-samples): Sample Terraform plan JSON files exported from terraform show -json style payloads for dependency visualization and change review
- [Hex/Unicode Encoding Format Samples](https://elysiatools.com/en/samples/text-hex-unicode-formats): Examples of hex (\xXX) and unicode (\uXXXX) escape sequence encoding formats
- [WebRTC Real-Time Communication Samples](https://elysiatools.com/en/samples/webrtc-samples): Comprehensive WebRTC samples for peer-to-peer audio/video communication, data channels, screen sharing, and signaling server implementation