JWT HS256 Verifier

Check an HMAC signature in the browser; a valid signature alone does not establish issuer, audience, expiry policy, or authorization.

HS256 JWT verification
Cryptographic signature status and claim-time status are shown separately to avoid implying more trust than was actually checked.

LocalNo account

HS256 JWTShared secret

—Signature

—Secret bytes

—Expiry

—nbf / iat state

ReadyOnly alg=HS256 is accepted. Verification does not establish authorization policy.

Trust and standards boundaries

Formatting is not schema validation, Base64 is not encryption, URL normalization is not a privacy guarantee, UUID metadata is not provenance, and decoded JWT claims are not trusted until cryptographic and application-specific validation succeeds. RS256 tools accept explicit PEM key formats and do not fetch issuer keys or make authorization decisions.

How to use this JWT HS256 Verifier

Paste an HS256 JWT and the shared secret, then review signature status, secret byte length, expiry state, and not-before/issued state separately.