Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Security

JWT Inspector & Verifier

· Last updated：2026-06-18

Decode a JWT (header + payload) with syntax highlighting, diagnose standard claims, and verify the signature with HS*/RS*/PS*/ES*/EdDSA keys — plus a tampered-token forgery demo

Details

What this tool helps you do

Paste a compact JWT (JWS) and the tool will:

  1. base64url-decode the header and payload into readable, syntax-highlighted JSON.
  2. Run claim diagnostics on exp / nbf / iat / iss / aud / sub / jti, flagging expired, not-yet-valid, or missing claims.
  3. Verify the cryptographic signature against a shared secret (HS) or an asymmetric public key in PEM or JWK form (RS, PS, ES, EdDSA).
  4. Optionally re-sign a tampered payload with your key to demonstrate why a verifier MUST pin the expected alg and reject tokens that pass signature checks but were minted by the wrong party.

Security notes:

  • Verification happens server-side using Node crypto. The secret/key never leaves the request.
  • alg=none tokens are reported and never accepted as valid.
  • Always enforce the expected algorithm and issuer/audience on your own backend; this tool is for inspection and education.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team
JSON107
Keys17

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Security
Input types
textarea, select, text, number
Output type
html
Sample coverage
4
API ready
Yes

Overview

The JWT Inspector & Verifier allows you to decode JSON Web Tokens (JWT) into readable JSON, diagnose standard claims like expiration and issuer, and cryptographically verify signatures using shared secrets or asymmetric public keys.

When to use

  • When debugging authentication issues and you need to inspect the header and payload claims of a JWT.
  • When verifying if a JWT signature is valid using a shared HS* secret or an asymmetric RS*/PS*/ES*/EdDSA public key.
  • When testing how your backend handles clock skew or simulated token forgery attempts.

How it works

  1. 1Paste your compact JWT token into the input field.
  2. 2Select your verification mode: decode only, verify signature, or run a forgery demo.
  3. 3Provide the shared secret for HS* algorithms, or the public key in PEM or JWK format for RS*, PS*, ES*, or EdDSA algorithms.
  4. 4Review the syntax-highlighted JSON payload, claim diagnostics such as expiration status, and the signature verification result.

Use cases

  • Inspecting JWT payload claims to debug user roles, permissions, or expiration times during development.
  • Validating token signatures generated by identity providers using their public JWK or PEM keys.
  • Simulating token tampering to verify that your application's signature validation logic is secure.

Compare alternatives

  • Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its paramete…

  • Decode JWT tokens

  • Drop any game save file — Minecraft NBT, Unreal Engine GVAS, Palworld containers, JSON/XML/INI/Lua text saves, SQLite profiles — and get the detected format,…

Who it's for

Best for

  • Parse content in the browser.
  • Workflows where Verification Mode matters, such as Decode only or Verify signature.
  • The “Decode and verify a sample HS256 token” workflow, done in one pass.

Not ideal for

  • Fully automated batch jobs — this page is built for interactive use; use the API endpoint for scripts.
  • Content in other formats — this tool expects content.

Edge cases & common failures

  • Very large files

    Large files take longer and can hit browser memory limits — try a smaller sample first.

  • Skipping the output check

    Compare the first rows or pages of the output with the input before using it in production.

  • Files from unusual exporters

    Some files use format variants that do not convert cleanly — if the output looks wrong, re-save the file from the app that created it and try again.

Examples

1. Verifying an HS256 API Token

Backend Developer

Background

A developer is building a Node.js API that uses HS256-signed JWTs for authentication and needs to verify if a generated token has a valid signature.

Problem

The developer needs to check if the token's signature matches the shared secret and inspect the claims.

How to use

Paste the JWT token, select 'Verify signature' mode, and enter the shared secret in the designated field.

Mode: Verify signature, Secret: demo-secret-2026

Outcome

The tool decodes the header and payload, runs claim diagnostics, and confirms the signature is valid.

2. Checking RS256 Token Claims and Public Key Signature

Security Engineer

Background

An engineer is auditing tokens issued by an external identity provider using RS256.

Problem

They need to verify the token signature against the provider's public PEM key and check for expired claims.

How to use

Paste the RS256 token, select 'Verify signature', and paste the public key PEM block into the public key field.

FAQ

Does this tool support asymmetric algorithms like RS256 or ES256?

Yes, you can verify signatures using RS*, PS*, ES*, and EdDSA algorithms by providing the public key in PEM or JWK format.

Are my secrets and keys safe when using this verifier?

Yes. Verification is performed server-side using Node crypto, and your keys or secrets are never stored or exposed.

How does the tool handle tokens with the none algorithm?

Tokens using the "none" algorithm are flagged as insecure and are never accepted as valid signatures.

What is the purpose of the forgery demo mode?

It demonstrates how tampering with a payload and re-signing it behaves, highlighting why backends must strictly enforce expected algorithms.

Can I account for system clock differences during claim diagnostics?

Yes, you can configure the reference clock skew in seconds to prevent false expiration flags due to minor time differences.

Home
Tools3201
Samples593
Visualizations465
Viewers103
Hubs233
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance644

Calculators, numerics, date logic, statistics, and finance tools

Design & Color297

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff
Stripe Promo Code Batch Review and Import Preflight
Batch Photo Culling Review and Editing Shortlist Handoff
UI Screenshot Structure Review and Development Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
Security

JWT Samples

Comprehensive JWT examples from basic token structure to advanced security implementations

Development

Terraform Plan JSON Samples

Sample Terraform plan JSON files exported from terraform show -json style payloads for dependency visualization and change review

text-processing

Hex/Unicode Encoding Format Samples

Examples of hex (\xXX) and unicode (\uXXXX) escape sequence encoding formats

Web Technologies

WebRTC Real-Time Communication Samples

Comprehensive WebRTC samples for peer-to-peer audio/video communication, data channels, screen sharing, and signaling server implementation

Security

JWK Generator & Parser

Generate JSON Web Keys (JWK) for RSA, EC (P-256/P-384/P-521/secp256k1), and OKP (Ed25519/Ed448/X25519/X448), or parse an existing JWK to inspect its parameters, thumbprint, and metadata

Cryptography

WebAuthn Passkey Assertion Decoder & Challenge Debugger

Decode WebAuthn/FIDO2 assertion fields, inspect authenticatorData flags and signCount, check challenge/origin/rpIdHash binding, and optionally verify ES256, RS256, or Ed25519 signatures with a supplied COSE public key.

Security

JWT Decoder

Decode JWT tokens

Development

Game Save Viewer

Drop any game save file — Minecraft NBT, Unreal Engine GVAS, Palworld containers, JSON/XML/INI/Lua text saves, SQLite profiles — and get the detected format, engine versions, key progress fields and a bounded structural tree.

Mode: Verify signature, Public Key: -----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----

Outcome

The tool decodes the token, flags any expired claims, and verifies the cryptographic signature using the public key.

JWK Generator & Parser
JWT Decoder
Game Save Viewer