JWS tester

The JWS tester validates and decodes JSON Web Signatures and JWTs to reveal headers, payloads, and the verification status. It accepts a token string and a signing key or shared secret, accepts an algorithm, and returns a structured result indicating whether the signature checks out. It supports common algorithms (HS256/384/512, RS256/384/512, ES256/384/512) and optional JWKS-based key lookup. The tool is designed for developers, security teams, and API integrators who need reproducible results during integration testing, security reviews, or incident investigations.
Conceptually, the tool decodes the JOSE object, recomputes the signature from the header and payload using the specified key and algorithm, and compares it to the signature in the token. It then reports decoded header and payload as JSON, flags signature validity, and surfaces precise error codes if verification fails. It also offers optional validation of standard claims (exp, iss, aud) and clock skew tolerance. When keys are provided via JWKS, the verifier can fetch and cache keys to match the kid in the header. Outputs are deterministic and suitable for automated pipelines.
Users gain immediate, actionable diagnostics and integration-ready data, reducing debugging time and improving API security testing coverage. The tool differentiates itself with explicit error taxonomies, support for multiple algorithms, and optional claim validation, all without requiring a full cryptography stack or UI.