JWT Verifier — Check an HMAC Signature and Claims Locally

RS256 is asymmetric: verifying needs the issuer's public key, which usually means fetching a JWKS document over the network. Doing that here would mean either sending your token to a server or fetching a third-party URL on your behalf. A tool that showed a green tick without genuinely checking would be worse than one that says plainly it cannot.

The token never leaves your browser. That said, a JWT is a bearer credential — anyone holding it can act as you until it expires — so if you have pasted a production token anywhere at all, including a chat message on the way here, treat it as compromised and rotate it.

A JWT declares its own algorithm in its header. If a server trusts that field, an attacker can change it to "none", strip the signature and forge any claims they like. Every current library rejects it by default, but the vulnerability recurs whenever someone verifies with the algorithm the token names rather than the one they expect.

No. A valid signature only proves the contents have not been altered — it says nothing about whether the token is still in date. Both checks have to pass, and forgetting the second is a common and serious authentication bug.