Verify a JWT Signature
Sign and verify JSON Web Tokens with HS256, RS256, and ES256. Test PKCE OAuth flows. Everything runs in your browser — no secrets are uploaded.
Open JWT & OAuth Security Toolkit with a ready-to-run example.
- You want to confirm that your auth service is signing tokens with the correct secret before deploying.
- You need to verify a token you received against a known secret or public key.
- You are debugging a 401 Unauthorized error and suspect a signature mismatch.
- You need to generate a PKCE
code_verifierandcode_challengefor an OAuth authorization flow.
- Open the JWT & OAuth Security Toolkit and select the Sign/Verify tab.
- Choose your algorithm (HS256 for shared secrets, RS256 for RSA key pairs).
- For HS256: paste your shared secret, enter the payload JSON, and click Sign to generate a token — then paste it back and click Verify to confirm the round-trip.
- For PKCE: switch to the PKCE tab, click Generate, and copy the
code_verifierandcode_challengefor your OAuth request.
- HS256 uses the same secret for signing and verifying — keep it confidential.
- RS256 uses a private key to sign and the corresponding public key to verify. Paste the public key (PEM format) for verification only.
- The PKCE
code_challengeis S256 (SHA-256 hash of the verifier) by default, which is required by most modern providers. - Algorithm confusion attacks occur when a server accepts RS256 tokens verified with the public key treated as an HS256 secret. Always pin the expected algorithm.
HS256 sign and verify round-trip
{
"sub": "user_456",
"role": "editor",
"iat": 1700000000,
"exp": 1700086400
}
my-super-secret-key-2024
Signature valid ✓ Algorithm: HS256
HS256, HS384, HS512 (HMAC shared secret), RS256 (RSA 2048+ public/private key pair), and ES256 (ECDSA P-256). All cryptography uses the browser's built-in Web Crypto API.
Proof Key for Code Exchange is an OAuth 2.0 extension (RFC 7636) that protects the authorization code flow for public clients. You generate a random code_verifier, hash it to produce the code_challenge, and include the challenge in the authorization request.
No. All cryptographic operations run entirely in your browser using the Web Crypto API. Your secrets, private keys, and tokens are never transmitted to any server.
Signing creates a JWT with a cryptographic signature using your secret or private key. Verifying checks that an existing token's signature matches the expected secret or public key — confirming the token was not tampered with.
Privacy-first: runs locally in your browser. No uploads.