JWS Signature Verification Online
Loading!
Verification Result
Verification result will appear here
Paste a JWS token and click "Verify JWS Signature"
Related JWS/JWT Tools
- JWS Generator - Generate keys & sign payloads
- JWS Parser - Decode and inspect JWS tokens
- JWS Sign - Sign with custom keys
- JWK Generator - Generate JSON Web Keys
- JWK to PEM - Convert key formats
- JWT Parser - Decode JWT tokens
Support This Free Tool
Every coffee helps keep the servers running. Every book sale funds the next tool I'm dreaming up. You're not just supporting a site — you're helping me build what developers actually need.
JWS Signature Verification Guide
JWS Signature Verification is the process of cryptographically validating that a JSON Web Signature token has not been tampered with and was signed by a trusted party.
How JWS Verification Works
- Extract the algorithm from the header
- Compute HMAC over
header.payloadusing the shared secret - Compare computed signature with the token's signature
- If they match, signature is VALID
- Extract the algorithm from the header
- Decode the signature from Base64URL
- Use the public key to verify the signature over
header.payload - If verification succeeds, signature is VALID
Common Verification Errors
| Error | Cause | Solution |
|---|---|---|
| Signature Invalid | Wrong key or modified token | Verify you're using the correct key that matches the signing key |
| Algorithm Mismatch | Using HMAC key with RSA algorithm or vice versa | Check the alg header and use the appropriate key type |
| Key Format Error | Invalid PEM format or encoding | Ensure public keys include BEGIN/END markers and proper Base64 encoding |
| Invalid JWS Format | Token doesn't have three parts | JWS must be in format: header.payload.signature |
Verification Security Best Practices
- Always verify signatures - Never trust a JWS/JWT without cryptographic verification
- Whitelist algorithms - Only accept expected algorithms, reject
alg: none - Validate claims after verification - Check
exp,nbf,iss,aud - Use constant-time comparison - Prevent timing attacks (handled by crypto libraries)
- Protect your keys - Keep shared secrets and private keys secure
JWS Structure Reference
Header - Contains alg (algorithm) and optionally typ, kid
Payload - Contains claims (sub, name, iat, exp, etc.)
Signature - Cryptographic signature over header.payload
About This Tool
This JWS verification tool is developed by Anish Nath ( @anish2good), a Security Engineer specializing in cryptography and web security.
- Privacy-First: Your tokens and keys are processed server-side and not stored
- Standards Compliant: Implements RFC 7515 (JWS) verification
- All Algorithms: Supports HMAC, RSA PKCS#1, RSA PSS, and ECDSA