Skip to content
CrateX.app logo

CrateX.app

JWT Signature Verifier

Verify a JWT signature locally with a secret or public key, and optionally check issuer, audience, expiration, and not-before claims.

JWT

Choose the expected algorithm independently. The token’s header.alg never changes this selection.
Choose the key family explicitly to prevent algorithm/key confusion. The token’s alg never changes this selection.

Algorithm declared by token

Unknown

Public key

Only an SPKI PUBLIC KEY PEM block or one public JWK is supported.

Allows this many seconds of clock skew when checking time claims.
Private, local verification
Verification runs entirely in your browser. Your token, secret or public key, expected issuer, expected audience, and verification result are not written to the URL, Workspace, or WebDAV.
When WebDAV sync is enabled, only four non-sensitive preferences may sync: expected algorithm, verification key type, secret encoding, and clock tolerance.
Ready to verify
Choose the expected algorithm independently. The token’s header.alg never changes this selection.
JWT Signature Verifier

Quick Start

1
Paste a compact, signed JWT with exactly three dot-separated parts.
2
Enter the matching HMAC secret, SPKI PEM public key, or one public JWK.
3
Optionally set the exact issuer, audience, and clock tolerance you expect.
4
Verify, then inspect the algorithm, key format, Header, and Claims without treating them as authorization.

Common Scenarios

API debugging

Check whether a token and known key produce a valid signature.

Algorithm migration

Confirm tokens during an HS, RS, PS, or ES signing-key transition.

Key pairing

Check whether a public key corresponds to a signed token.

Claim checks

Compare iss, aud, exp, and nbf with the values expected by your integration.

Usage Advice

Obtain verification keys through a trusted channel and confirm which issuer and audience your backend expects.
Treat HMAC secrets and tokens as sensitive; clear them when you finish, especially on shared devices.
Use this browser check for diagnosis only. Your backend must still enforce authorization, revocation, session, and business rules.

Verification Contract

Input must be a compact JWS JWT with exactly three parts: header.payload.signature. Five-part JWE and nested or custom token formats are outside this tool.
Choose the key family and expected algorithm independently. The self-declared header.alg never changes either selection; all three must agree. HS uses UTF-8 or Base64URL, while RS/PS/ES uses SPKI PEM or one public JWK.
The tool verifies the signature, applies exp and nbf time checks, and checks iss or aud only when you provide expected values. Clock tolerance applies to time checks.

Security Boundary

A valid signature shows that the token bytes match the supplied key under the declared algorithm. It does not establish who supplied that key or whether the issuer is trusted.
This result does not check scopes, roles, permissions, revocation, logout, session state, nonce, azp, subject policy, or other business rules, and it does not grant access.
Confirm the key, issuer, audience, and algorithm policy independently. A wrong but internally matching token-and-key pair can still verify here.
Unsupported: JWE, token issuance or signing, private keys, X.509 certificates, EdDSA, multiple-key JWK sets or JWKS, OIDC discovery, remote key fetching, and server-side introspection.

Limitations & Compatibility

Only signed three-part compact JWS JWTs are accepted; encrypted five-part JWE tokens are not.
Only the HS, RS, PS, and ES algorithms supported by this tool can be verified; alg none and EdDSA are rejected.
Public-key verification accepts only an SPKI PUBLIC KEY PEM block or a single public JWK, not private keys, certificates, JWKS, or key URLs.
There is no network lookup, OIDC discovery, JWKS refresh, revocation check, token issuance, signing, download, or result sharing.

Privacy & Security

All parsing and verification run locally in your browser. Tokens, secrets, PEM/JWK data, issuer, audience, and results are not uploaded or stored in the URL, Workspace, or WebDAV. When WebDAV sync is enabled, only four non-sensitive preferences may sync: expected algorithm, verification key type, secret encoding, and clock tolerance.
Use a private device for sensitive credentials, clear the fields after use, and avoid untrusted browser extensions or screen sharing.

FAQ

6

Continue with these related tools for the next step.

About

About Us
Pricing

Legal

Terms
Privacy Policy
Cookie Policy

Preferences

Manage Cookies

All tool processing happens locally in your browser.