Does this tool support asymmetric algorithms like RS256 or ES256?

Yes, you can verify signatures using RS*, PS*, ES*, and EdDSA algorithms by providing the public key in PEM or JWK format.

Are my secrets and keys safe when using this verifier?

Yes. Verification is performed server-side using Node crypto, and your keys or secrets are never stored or exposed.

How does the tool handle tokens with the none algorithm?

Tokens using the "none" algorithm are flagged as insecure and are never accepted as valid signatures.

What is the purpose of the forgery demo mode?

It demonstrates how tampering with a payload and re-signing it behaves, highlighting why backends must strictly enforce expected algorithms.

Can I account for system clock differences during claim diagnostics?

Yes, you can configure the reference clock skew in seconds to prevent false expiration flags due to minor time differences.

Elysia Tools

Navigation

Security

JWT Inspector & Verifier

Decode a JWT (header + payload) with syntax highlighting, diagnose standard claims, and verify the signature with HS*/RS*/PS*/ES*/EdDSA keys — plus a tampered-token forgery demo

Details

What this tool helps you do

Paste a compact JWT (JWS) and the tool will:

base64url-decode the header and payload into readable, syntax-highlighted JSON.
Run claim diagnostics on exp / nbf / iat / iss / aud / sub / jti, flagging expired, not-yet-valid, or missing claims.
Verify the cryptographic signature against a shared secret (HS) or an asymmetric public key in PEM or JWK form (RS, PS, ES, EdDSA).
Optionally re-sign a tampered payload with your key to demonstrate why a verifier MUST pin the expected alg and reject tokens that pass signature checks but were minted by the wrong party.

Security notes:

Verification happens server-side using Node crypto. The secret/key never leaves the request.
alg=none tokens are reported and never accepted as valid.
Always enforce the expected algorithm and issuer/audience on your own backend; this tool is for inspection and education.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Result

Ready for a run

Run the tool to preview files, text, structured data, or streamed output here.

Samples

JWT Inspector & Verifier

What this tool helps you do

Run this tool

Prepared example runs

Inputs

Result

Examples that match this tool

Continue with connected tools and hubs

Prepared example runs

Inputs

Result

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Overview

When to use

How it works

Use cases

Examples

1. Verifying an HS256 API Token

2. Checking RS256 Token Claims and Public Key Signature

FAQ

JWT Samples

Terraform Plan JSON Samples

Hex/Unicode Encoding Format Samples

WebRTC Real-Time Communication Samples

JWK Generator & Parser

WebAuthn Passkey Assertion Decoder & Challenge Debugger

JWT Decoder

Distributed Trace Decoder & Waterfall Visualizer

JSON Interchange and Format Translation Tools

JSON Inspection, Diff, and Transformation Tools

JSON Schema, Mock Data, and API Fixture Generators

JSON Formatting, Diff, and Normalization Tools