UUID Studio

UUID Studio

JWT Signature Verifier

Actually verify an HS256 JWT's signature, not just decode it.

  • đź”’ No data stored or uploaded
  • ⚡ 100% client-side
  • 🆓 Free, no account
Click Convert when ready

Override only when Auto cannot parse your paste. Changing this loads a matching sample into Input — click Convert to run. Use Load sample to cycle every format example.

All conversions

Read-only representations of the same 16 bytes. Every textual form is listed here, not in “Prefer format”.

Paste two values: if both sides are valid JSON, a structural diff appears; otherwise UUID / bytes are compared when both decode to the same format.

A
B

Create or edit JSON here (syntax colors), then format, validate, or convert - same as MongoDB $binary UUID blobs on the Convert tab once detected.

New document

Hash, HMAC, AES-GCM/CBC + RSA-OAEP, codecs, JWT decoding, UUID v4, and secure random - all client-side. JWTs use Base64URL (three segments), not a single MIME Base64 block - use Decode JWT below, not raw Base64 decode.

Examples

  • Sample HS256 JWT (secret: your-256-bit-secret) 
    eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

About JWT Signature Verifier

Every JWT decoder, including our own, says the same thing: decoding is not verifying. Anyone can read the claims inside an unsigned-looking token, but that tells you nothing about whether it was actually issued by your server and hasn't been tampered with.

Paste a token and its HS256 signing secret, and this recomputes the HMAC over the header and payload and compares it byte-for-byte against the token's signature - the same check your backend's JWT library performs before trusting a request.

This only supports HS256 (shared-secret HMAC), matching the JWT Generator on this site. RS256 and other asymmetric algorithms need the issuer's public key rather than a shared secret and aren't covered here - verify those with your backend framework's JWT library instead.

FAQ

Why does it only support HS256?
HS256 verification only needs the shared secret, which is safe to demonstrate client-side. RS256/ES256 verification needs the issuer's actual public key infrastructure, which is a different (and riskier to fake) workflow - use your backend's auth library for those.
What does 'expired' mean in the result?
It checks the token's exp claim (if present) against your current browser clock and reports whether the token has already expired - independent of whether the signature itself is valid.
Is my secret uploaded anywhere?
No. The HMAC is computed locally with the Web Crypto API; nothing you paste leaves your browser tab.