JWT Verifier

Only HS256. The expected algorithm is fixed; a token cannot switch the verifier to RS256, HS384, or HS512. alg:none never counts as authenticated, even with an empty signature. Critical header extensions and unencoded payloads are unsupported.

Enter the exact UTF-8 text used as the HMAC key, including any significant spaces. The field does not decode Base64url, Base64, hexadecimal, PEM, or JWK keys. If the issuer uses decoded binary key bytes, use a verifier that supports that key encoding.

No. It only means that the HS256 MAC matches the supplied secret. The application must also enforce issuer, audience, time, permissions, and revocation policies. A correctly signed token can still be expired or unacceptable.

exp and nbf must be finite NumericDate numbers in seconds. At the device time captured when verification starts, exp must be strictly greater than the current time; nbf may equal the current time. No clock leeway is applied. iat is displayed only, and missing claims are labeled rather than treated as proof of validity.

The tool processes inputs in page memory, does not upload them, and does not save them to browser storage or send their values to analytics. Old drafts saved by previous versions are removed on opening the tool. Copy claims explicitly writes decoded claims to the system clipboard.

Use three compact JWS segments separated by dots, with canonical unpadded Base64url encoding. Header and payload must decode to UTF-8 JSON objects. Leading and trailing whitespace around the complete token is ignored; padding and whitespace inside a segment are rejected. Input is limited to 128 KiB.