What is Jwt Hs256 Verifier
The JWT HS256 Verifier verifies that a JSON Web Token signed with the HMAC-SHA256 algorithm is authentic by recomputing the signature using a shared secret you provide. Paste the JWT and the secret key, and the tool decodes the token, recomputes the HMAC signature, and compares it to the token's signature — if they match, the token is verified as authentic and unmodified.
How to Use Jwt Hs256 Verifier
- Paste the complete JWT into the input panel — all three dot-separated segments.
- Enter the HMAC secret key in the Secret field — this is the same secret used to sign the token.
- Click Verify — the tool recomputes the HMAC-SHA256 signature and compares it to the token's signature.
- Read the result — Valid means the signature matches and the token is authentic. Invalid means the signature doesn't match, the token was modified, or the wrong secret was used.
- Check the payload — the decoded payload shows all claims, including expiration status.
Why Use Jwt Hs256 Verifier
HS256 is the most common JWT signing algorithm — it's used by Auth0, AWS Cognito, and many OAuth2 providers. It uses a shared secret (both the signer and verifier know the same key), which makes it simpler than RSA-based algorithms but requires secure secret management. This tool lets you verify tokens without running a server or installing a JWT library — useful for debugging authentication flows, testing token generation, and understanding how HMAC verification works.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
What is the difference between HS256 and RS256?
HS256 uses a shared secret (symmetric) — both the signer and verifier use the same key. RS256 uses a key pair (asymmetric) — the signer uses a private key, and anyone can verify with the public key. RS256 is more secure for distributed systems because the verification key can be public. HS256 is simpler and faster, but the secret must be shared securely with all verifiers.
My secret is a Base64 string — do I decode it first?
It depends on how the token was signed. If the signing library used the raw bytes of the Base64 string (without decoding), use the Base64 string as-is. If it decoded the Base64 first, you need to decode it before pasting. Check your token generation code to see which approach was used. Most libraries use the raw string, not the decoded bytes.
Can I verify any JWT algorithm with this tool?
No — this tool specifically verifies HS256 (HMAC-SHA256). For RS256, ES256, or other asymmetric algorithms, use the JWT RS256 Verifier tool. The algorithm is specified in the token's header — check the alg field to know which verification tool to use.
What happens if I use the wrong secret?
The tool will report the token as Invalid. The HMAC signature is computed from the payload and the secret — a different secret produces a completely different signature. This is by design: only someone with the correct secret can verify the token. The tool shows the expected signature for debugging purposes.