Verify HS256 JWT signatures, inspect token claims, decode JWK JSON, and compare shared-secret signatures locally.
Verify HS256 tokens and inspect key metadata.
Recalculate HMAC SHA-256 signatures with Web Crypto and compare them safely.
Paste JWK JSON to inspect key type, key ID, algorithm, usage, and operations.
Check exp and nbf timing claims while verifying the signature.
Generate a valid sample token and shared secret for demos.
Tokens and secrets stay in the browser tab.
Designed for diagnostics, not for replacing server-side auth checks.
This verifier supports HS256. Asymmetric RS/ES verification can be added later with PEM/JWK import flows.
Avoid pasting production secrets into browser tools. Use test tokens and rotate anything accidentally shared.
No. You still need to validate issuer, audience, expiration, subject, scopes, and application-specific claims on the server.