Offline JWT Signature Verifier & RSA/HMAC Debugger 100% Client-Side Web Crypto

JSON Web Tokens (JWT) are defined under RFC 7519 as compact, URL-safe means of representing claims to be transferred between two parties. A standard JWT comprises three base64url-encoded parts separated by periods: Header, Payload, and Digital Signature.

Our in-browser signature verification tool uses the native W3C Web Cryptography API (crypto.subtle) to verify token integrity with hardware acceleration on your CPU. It supports symmetric HMAC algorithms (HS256, HS384, HS512) using secret passphrases, and asymmetric public key algorithms (RS256, RS384, RS512, ES256, ES384, ES512) using PEM-formatted X.509 public certificates or JWK keys.

Because verification executes locally inside browser memory, your private API secrets, OAuth access tokens, and enterprise session cookies are never transmitted to any third-party server.

1. Paste your raw Bearer or ID token into the JWT input editor.

2. Inspect the automatically decoded JOSE Header and Claims payload with human-readable timestamps.

3. Select the verification algorithm (HS256 for symmetric secrets or RS256/ES256 for public keys).

4. Enter your HMAC shared secret string or paste your public key in PEM format (-----BEGIN PUBLIC KEY-----).

5. The tool instantly validates the cryptographic signature and reports whether the token is authentic, expired, or tampered with.

Critical security bugs occur in authentication backends when signature verification accepts tokens where the algorithm header is set to 'none' or when libraries fail to validate the expiration claim (exp).

Our client-side inspector flags expired tokens with high-contrast warning badges, detects clock drift, and validates that the signature precisely matches the SHA-256 digest of header.payload.

Decode JWT claims and expiration timestamps in real time with our JWT Decoder, verify cryptographic message authentication signatures with the HMAC Generator, or inspect binary keys using the Base64 to Hex Converter.