Cryptographic verification
JWT Signature Verifier
Verify a JWT signature with an HMAC secret, SPKI PEM public key, single JWK, JWKS JSON or a trusted HTTPS JWKS URL using the browser Web Crypto API.
Verification uses the browser Web Crypto API. The JWT and key material are not sent to a verification API.
A valid signature proves integrity relative to the supplied key; it does not by itself prove that you supplied the correct trusted key or that claims such as issuer, audience and expiration are acceptable for your application.
Supported JWT signature algorithms
HMAC
HS256 · HS384 · HS512
Use the shared signing secret as UTF-8 text and treat production secrets as sensitive credentials.
Public-key algorithms
RS256/384/512 · PS256/384/512 · ES256/384/512
For RS, PS and ES, use SPKI PEM, a single JWK, JWKS JSON or an HTTPS JWKS URL. kid and key metadata are checked before Web Crypto verification.
A successful signature check proves integrity relative to the key you supplied.
For signature-only checks, this verifier can use a trusted JWKS directly. Use the JWKS Validator when you also need issuer, audience, time-claim and key-selection diagnostics.
Recommended signature verification guides
These are the guides I use when a token decodes but the signature still fails.
How I Debug a JWT Invalid Signature Error
Troubleshoot signature mismatches and wrong keys.
Read guide →How I Choose Between HS256 and RS256 for JWT Signing
Compare shared-secret and public-key models.
Read guide →How I Handle JWT alg none Without Accidentally Trusting It
Avoid unsafe algorithm handling.
Read guide →How I Debug JWT kid and JWKS Key Selection
Trace key-selection problems.
Read guide →