{
  "slug": "jwt-verify",
  "name": "gizza-ai/jwt-verify",
  "version": "0.1.0",
  "title": "JWT Verify — Validate a JSON Web Token signature & claims — gizza.ai",
  "description": "Verify a JWT signature (HS256/384/512, RS256/384/512, ES256/384) and its exp, nbf, iss and aud claims in your browser — token and key never leave your device.",
  "tags": [
    "jwt verify",
    "jwt validator",
    "json web token",
    "jws",
    "verify jwt signature",
    "hs256",
    "rs256",
    "es256",
    "jwt decoder"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/jwt-verify/",
    "markdown": "https://gizza.ai/tools/jwt-verify/index.md",
    "descriptor": "https://gizza.ai/tools/jwt-verify/tool.json",
    "deep_link_example": "https://gizza.ai/tools/jwt-verify/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0....&key=your-256-bit-secret%20%20%20%28or%20paste%20a%20PEM%20PUBLIC%20key%20for%20RS%2A%2FES%2A%29&algorithm=&issuer=https%3A%2F%2Fissuer.example.com&audience=my-api&leeway=0"
  },
  "cli": "gizza tool jwt-verify \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0....\" 'key=your-256-bit-secret   (or paste a PEM PUBLIC key for RS*/ES*)'",
  "tool": {
    "description": "Verify a JSON Web Token (JWT, JWS compact serialization): check its signature against a key and validate the standard exp/nbf/iss/aud claims. Set algorithm=HS256/384/512 (HMAC with a shared secret), RS256/384/512 (RSASSA-PKCS1-v1_5 with a PEM RSA public key) or ES256/384 (ECDSA with a PEM P-256/P-384 public key) to REQUIRE that algorithm (recommended; defends against alg-confusion) — leave it empty to use the token's own alg ('none' is always rejected). 'token' is the compact JWT; 'key' is the HMAC secret (HS*) or PEM public key (RS*/ES*); optional 'issuer'/'audience' assert the iss/aud claims; 'leeway' tolerates clock skew on exp/nbf; 'now' is the current Unix time for time checks. Returns {valid, algorithm, error, header, payload, checks[]}. Runs locally — the token and key never leave the device.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "algorithm": {
          "description": "Optional required algorithm — if set, the token's 'alg' header must equal it (defends against algorithm-confusion attacks). Leave empty to accept the token's own alg (except 'none', which is always rejected).",
          "enum": [
            "",
            "HS256",
            "HS384",
            "HS512",
            "RS256",
            "RS384",
            "RS512",
            "ES256",
            "ES384"
          ],
          "type": "string"
        },
        "audience": {
          "description": "Optional expected 'aud' claim. If set, verification fails unless the token's audience (string or array) contains this value.",
          "type": "string"
        },
        "issuer": {
          "description": "Optional expected 'iss' claim. If set, verification fails unless the token's issuer matches exactly.",
          "type": "string"
        },
        "key": {
          "description": "The verification key: for HS* the shared HMAC secret string; for RS*/ES* a PEM-encoded PUBLIC key ('-----BEGIN PUBLIC KEY-----' SPKI, or '-----BEGIN RSA PUBLIC KEY-----' PKCS#1 for RSA).",
          "type": "string"
        },
        "leeway": {
          "description": "Clock-skew tolerance in seconds applied to exp/nbf (default 0).",
          "minimum": 0,
          "type": "integer"
        },
        "now": {
          "description": "Current time as seconds since the Unix epoch, used for exp/nbf checks. The chat client supplies this automatically; pass it explicitly when calling directly.",
          "minimum": 0,
          "type": "integer"
        },
        "token": {
          "description": "The compact JWT to verify, i.e. the header.payload.signature string.",
          "type": "string"
        }
      },
      "required": [
        "token",
        "key"
      ],
      "type": "object"
    }
  }
}