JWT Inspector & Verifier

Paste a compact JWT (JWS) and the tool will:

base64url-decode the header and payload into readable, syntax-highlighted JSON.
Run claim diagnostics on exp / nbf / iat / iss / aud / sub / jti, flagging expired, not-yet-valid, or missing claims.
Verify the cryptographic signature against a shared secret (HS) or an asymmetric public key in PEM or JWK form (RS, PS, ES, EdDSA).
Optionally re-sign a tampered payload with your key to demonstrate why a verifier MUST pin the expected alg and reject tokens that pass signature checks but were minted by the wrong party.

Security notes:

Verification happens server-side using Node crypto. The secret/key never leaves the request.
alg=none tokens are reported and never accepted as valid.
Always enforce the expected algorithm and issuer/audience on your own backend; this tool is for inspection and education.

Key Facts

Category: Security & Validation
Input Types: textarea, select, text, number
Output Type: html
Sample Coverage: 4
API Ready: Yes

Overview

The JWT Inspector & Verifier allows you to decode JSON Web Tokens (JWT) into readable JSON, diagnose standard claims like expiration and issuer, and cryptographically verify signatures using shared secrets or asymmetric public keys.

When to Use

•When debugging authentication issues and you need to inspect the header and payload claims of a JWT.
•When verifying if a JWT signature is valid using a shared HS* secret or an asymmetric RS*/PS*/ES*/EdDSA public key.
•When testing how your backend handles clock skew or simulated token forgery attempts.

How It Works

•Paste your compact JWT token into the input field.
•Select your verification mode: decode only, verify signature, or run a forgery demo.
•Provide the shared secret for HS* algorithms, or the public key in PEM or JWK format for RS*, PS*, ES*, or EdDSA algorithms.
•Review the syntax-highlighted JSON payload, claim diagnostics such as expiration status, and the signature verification result.

Use Cases

Inspecting JWT payload claims to debug user roles, permissions, or expiration times during development.

Validating token signatures generated by identity providers using their public JWK or PEM keys.

Simulating token tampering to verify that your application's signature validation logic is secure.

Examples

1. Verifying an HS256 API Token

Backend Developer

Background: A developer is building a Node.js API that uses HS256-signed JWTs for authentication and needs to verify if a generated token has a valid signature.
Problem: The developer needs to check if the token's signature matches the shared secret and inspect the claims.
How to Use: Paste the JWT token, select 'Verify signature' mode, and enter the shared secret in the designated field.
Example Config: Mode: Verify signature, Secret: demo-secret-2026
Outcome: The tool decodes the header and payload, runs claim diagnostics, and confirms the signature is valid.

2. Checking RS256 Token Claims and Public Key Signature

Security Engineer

Background: An engineer is auditing tokens issued by an external identity provider using RS256.
Problem: They need to verify the token signature against the provider's public PEM key and check for expired claims.
How to Use: Paste the RS256 token, select 'Verify signature', and paste the public key PEM block into the public key field.
Example Config: Mode: Verify signature, Public Key: -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----
Outcome: The tool decodes the token, flags any expired claims, and verifies the cryptographic signature using the public key.