Verify a JWT’s signature against a JWKS JWKS
A JWT is only good if its signature verifies against the issuer's keys and its claims still hold. This matches the key by kid, verifies the signature, and checks expiry, audience and issuer, without the token leaving the tab.
The token
The keys
Result
How it works
Signature and claims are two different checks
A token can have a perfect signature and still be rejected because it has expired, is not yet valid, or is for another audience. JWKS shows the signature verdict and the claim checks separately, so you know which one to fix. It never fetches the token's jku and nothing is uploaded, so it is safe for a live credential. To decode a token without keys, JOT.
Doing this often? OBSCURA Umbra edits the service that issues or checks the tokens, and runs JavaScript, TypeScript and Python in a sandbox. On its own, US$4 a month; with everything else, US$9 a month or US$79 a year. 7 days free.