JWT Signature Verifier
Check whether an HMAC-signed token really was signed with your secret. The secret is the most sensitive thing you own, which is exactly why this computation happens in your tab and the page is forbidden from opening a network connection at all.
Output appears here as you type.
Runs entirely in your browser. Nothing you paste here is uploaded or stored.
Questions
Am I really safe typing my signing secret into a web page?
Judge it rather than trusting it. The verification is a pure function in page JavaScript, and the page is served with a Content-Security-Policy of connect-src ‘none’, so the browser blocks any fetch, XHR, WebSocket or beacon it might attempt - a restriction the page cannot lift on itself. Load the page, disconnect from the network, and verify offline. Every deploy is gated on an automated check that tries to exfiltrate data by each of those routes and fails the release if any succeeds.
Which algorithms are supported?
The HMAC family - HS256, HS384 and HS512 - because those verify with a shared secret you already hold. RS256, ES256 and the other asymmetric algorithms verify with a public key and are not supported here yet.
The signature does not match. What now?
Usually the secret rather than the token. Check whether your secret is base64-encoded at rest - many frameworks store it that way and decode before signing, so pasting the encoded form fails. Also check for a trailing newline, which a copy from a file or an environment variable commonly carries.