JWT Verify Online — 14 Algorithms vs JWKS, PEM & Claims

Verify JWT signatures and optional exp/aud/iss claims in your browser. Live verify against pasted JWKS/JWK, public PEM, or HMAC secret, with the same algorithm set as jwt-encode/decode. Encode · Decode · Verify tabs. Paste-only, with no remote JWKS fetch. Signature verify ≠ authorization.

…
JWT verify, browser-local
Full-trust verify: signature plus optional time and audience claims. It accepts JWKS, a single JWK, SPKI/X.509 PEM, or an HMAC secret, and never fetches remote keys.

Developer notes

Editors start empty — use **Load sample** or pick an algorithm to load a demo fixture. Paste compact JWT first — trust material tabs follow the header alg. Algorithms: HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, EdDSA (same as jwt-encode/decode). `alg: none` is rejected. jwt-decode inline verify checks signature only; this tool adds exp/nbf/aud/iss policy. verify ≠ trust or authorization. Copy result never includes raw private JWKS material. 512 KB per field.

Options

Clock skew
Tolerance for exp/nbf, as a number of seconds: 0, 60, or 300.
Ignore expiration
Still verify signature; ignore exp claim failures.
Audience
When set, aud must match (string or array membership).
Issuer
When set, iss must match exactly.

When teams pick this route

Debug API auth with a JWKS from provider docs. Check exp/aud/iss after jwt-decode. Validate test tokens from jwt-encode fixtures (any supported alg).

Worked examples

RS256 JWT + matching JWKS

JWT

eyJhbGciOiJSUzI1NiIsImtpZCI6ImRvYy1yc2EifQ.eyJzdWIiOiJkZW1vLXVzZXIiLCJhdWQiOiJhcGkiLCJleHAiOjE4MTU3NzIxMDJ9.llca6yHME4h-6XH_GR9sFN6qIGiwyAfy9rUA2ezs9rRmdLEfCMAYSb5YvHo9hMd5PBsb7heUff-iXctMJFbRIWzKZhOcjwOuLc2Jkd9kxhwQoXdICS2liioMc4aNWyUj8-j-9YbsC7pu122EzZrFzpEED3kT4CVPT7WuVLTm9-EHoLSL-M1DhtwvTcX4C-w7mhI_SGkkQfd_J923-BlM0bltDqWZLAeia9dciRigloK615-s9P7mMjcYWIEtkV0h62LW_1t150tvPCTNlo4vBEBUhat8K47Oqt6qsecktPfPHzdigvT8DmBxCzIvb8jTuDtoEWssCt1dfuL67DWy6g

Result

{ "valid": true, "algorithm": "RS256" }

Related tools

Same JWT family: jwt-encode · jwt-decode. To inspect keys, use inspect-jwks · pem-jwk-converter.

JWT verify FAQ

Paste-only verify

Can I paste a JWKS URL?

No. Paste the JSON body of the JWKS, and nothing is fetched from the network.

Does verify mean the user is trusted?

No. This checks signature and optional claims only, not authorization or identity provider trust.

When should I use jwt-decode?

Use jwt-decode to read header/payload and optionally check signature inline. Use this tool for JWKS/PEM trust material and exp/aud/iss policy.

Which algorithms are supported?

Same 14 signing algorithms as jwt-encode/decode: HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, and EdDSA. Unsecured alg:none is rejected.

Can I use a public PEM instead of JWKS?

Yes. Use the Public PEM tab for SPKI or X.509 certificate PEM when you have a single asymmetric key.

Security & tokens

Inspect JWKS, verify JWTs, decode X.509 certificates, convert PEM and JWK, scan text for secrets and hash with bcrypt in your browser.

Explore other tool categories