JWT Signature Verifier

A JWT has three parts: header, payload, and signature. The signature proves the token wasn't tampered with and was issued by someone with the signing key. Verification recomputes the signature using the same algorithm and key, then compares it to the token's signature. If they match, the token is valid.

HMAC (HS256, HS384, HS512) uses a shared secret — the same key signs and verifies. Simple but requires secure key distribution. RSA (RS256, etc.) uses a private key to sign and a public key to verify. The public key can be shared openly; only the issuer needs the private key. RSA is preferred for distributed systems.

Always verify JWTs before trusting their contents. Decoding alone is not enough — anyone can create a fake JWT. Verification ensures the token was signed by the expected issuer and hasn't been modified. Use the issuer's public key (for RSA) or your shared secret (for HMAC).