JWT Verify Online (Free, Private) — HS256 & RS256
Verify JWT signatures online with HMAC secrets or RSA public keys. Free browser-based verification — no token upload.
Verifying a JWT proves the token was signed by someone who holds the secret or private key — not just that the payload looks valid. This is the step most decoders skip, and the one that matters for security.
HMAC verification (HS256, HS384, HS512)
Symmetric algorithms use a shared secret. Paste the JWT and enter the same secret your server uses. Utillio recomputes the signature locally and shows valid or invalid instantly.
RSA verification (RS256, RS384, RS512)
Asymmetric algorithms use a public key to verify tokens signed with a private key. Paste your PEM public key — the format Auth0, Firebase, and most OIDC providers publish in their JWKS endpoint.
When to verify vs decode
- Decode only — quick inspection of claims during development
- Verify — confirm a token is authentic before trusting its claims
- Always verify on your server in production — browser tools are for debugging