Keys, Certificates & Tokens
JWT Verifier
Verify a compact JWT with its secret or public key and inspect decoded claims. Enforce expected algorithm, issuer, and audience separately.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
JWT Verifier performs JSON Web Token library verification for the supplied key or certificate data. It passes the token to jsonwebtoken.verify with the implementation's algorithm list and returns decoded claims or an error.
It passes the token to jsonwebtoken.verify with the implementation's algorithm list and returns decoded claims or an error. This result runs in the browser for this catalog category. Processing runs in the browser.
Token verification here is a debugging result, not a complete production JWT validation or authorization policy.
Instructions
- Provide text or data for this tool.
- Preserve all three token segments when copying the fixture. This applies to JWT Verifier.
- Enforce your expected algorithm and claim policy in the receiving application. This applies to JWT Verifier.
Example
Input: Paste a complete disposable HS256 token and its matching HMAC secret into Public/Secret Key.
Settings: JWT Verifier: Use a public PEM key for asymmetric verification, not the signing private key. This tool exposes only Public/Secret Key; it has no expected-algorithm, issuer, or audience selector.
Result: It passes the token to jsonwebtoken.verify with the implementation's algorithm list and returns decoded claims or an error.
Limits
- JWT Verifier: This interface does not let you restrict verification to one expected algorithm.
- JWT Verifier: A returned payload is not an authorization decision or an issuer/audience policy check.