Verify a JWT using a secret or public JWK

Paste the token and trusted verification material, then choose inspect or verify. Decoding alone does not establish trust, and application authorization still needs separate checks.

Runs locally in your browser

LOCAL CRYPTOjose 6.2.10HS · RS · PS · ES · EdDSAWeb Crypto API

JWTs, HMAC secrets, and JWK material are handled in this browser. The verifier does not fetch a JWKS URL, send a token, or retain key material after the page session.

Compact JWT

Verification material

For HS256/384/512, enter the raw shared secret. For asymmetric algorithms, paste a public JWK or JWKS JSON document.

Claims overview

Protected header and payload

Decode or verify a compact JWT to inspect its protected header and payload.

Decode is not the same as verification

Anyone can decode a JWT payload. Treat a token as trusted only after a successful signature check with the intended algorithm and key, plus issuer, audience, time, and application-level claim validation.