JWT Signature Verifier
A JWT is three Base64URL parts — header, payload and signature — where the signature lets a server prove the token was issued by someone holding the key. This page verifies that signature with the browser's Web Crypto API, so you can test an auth flow without sending the token anywhere.
What does verification prove?
Verification checks that the header and payload were signed by the private key matching the public key you provide. It does not prove the token is trustworthy on its own: you must also check the issuer, audience, expiry and that the algorithm matches what your server expects.
RS/PS use RSA keys, ES uses ECDSA and HS uses a shared secret. Public-key algorithms let you verify with a PEM or JWK that cannot mint new tokens; HS secrets can do both, so keep them server-side.
This tool runs entirely in your browser. Your inputs and files are processed locally and are never sent to or stored on Kinetikatech servers.
Related pages
Server problem? Hacked site? Slow website?
Critical issues answered within 30 minutes, 24 hours a day, 7 days a week.