Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTo verify a compact signed JWT without a JWT library, verify its JWS signature or MAC with a trusted cryptographic primitive against the exact original signing input: the encoded protected-header segment, a period, and the encoded payload segment. Do not decode and reserialize the JSON first. Set your own algorithm allowlist, select a key from a trusted source, and validate the token’s claims separately after the cryptographic check. “Without a library” should mean without a JWT convenience library—not writing cryptography from scratch.
What this procedure verifies
A JWT is a claims format that can be carried in different JOSE constructions. This procedure is for a compact JWS-style JWT: a signed token or one authenticated with a message authentication code (MAC). It does not cover decrypting a JWE, which has five compact segments, or fully validating a nested construction. JWS is defined in RFC 7515; JWT is defined in RFC 7519.
As an Amazon Associate I earn from qualifying purchases.
A JWT library commonly handles token parsing, Base64url decoding, algorithm mapping, key selection, and claim checks as a bundle. If you remove that layer, your application must deliberately handle each part. Keep using a well-maintained platform or cryptographic library for the actual signature or MAC operation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy the original encoded segments matter
A compact JWS has three Base64url-encoded segments separated by periods: the protected header, payload, and signature. The signing input is the original first segment, a literal period, and the original second segment, as ASCII bytes:
#1 Best Overall
original-header-segment.original-payload-segment
Equivalently, the JWS signing input is the Base64url encoding of the UTF-8 protected-header bytes, followed by a period and the Base64url encoding of the payload bytes. The compact token already contains those encoded values. Preserve them exactly for verification; parsing the JSON and serializing it again can change whitespace, member order, or other bytes, producing a different signing input even when the JSON has the same meaning. See RFC 7515, Sections 3.1 and 5.2.
How to verify the compact JWS
- Split and validate the compact form. Require the expected three segments and reject malformed input. Do not treat a five-segment encrypted JWE as a signed compact JWS.
- Decode and inspect the protected header. Strictly Base64url-decode the header bytes and parse the JSON as UTF-8. Require an algorithm your application supports. Process any required or critical header parameters; reject a token if a parameter cannot be processed.
- Apply verifier-controlled algorithm policy. Check the declared
algagainst an allowlist configured by the application, not a list chosen by the token. Confirm that the selected key is compatible with the permitted algorithm. - Choose a trusted verification key. Get it from application configuration or a properly validated, issuer-controlled key-distribution process. A
kidmay identify a candidate among trusted keys, but it is not proof that the key is trustworthy. - Build the signing input from the untouched token. Concatenate the original encoded header segment, one period, and the original encoded payload segment. Use those bytes—not a newly serialized JSON representation—as input to the cryptographic operation.
- Decode and verify the signature. Strictly Base64url-decode the third segment. Call the algorithm-appropriate verification primitive with the selected key, exact signing input, and correctly represented signature.
- Reject on any failed requirement. Malformed encoding, unsupported parameters, an untrusted or incompatible key, a disallowed algorithm, or a failed cryptographic check means the token is not accepted as valid.
- Validate application claims and purpose. Only after signature or MAC verification, check the issuer, audience, expiration, not-before time, subject, intended token purpose, and any other requirements for your application.
RFC 7515’s validation procedure requires processing supported header parameters and validating the signature against the JWS signing input using the algorithm represented by alg. If a required step fails, the signature or MAC cannot be validated. See RFC 7515.
Set algorithm and key policy before checking tokens
The alg value comes from the token being checked; it is not authorization to run any operation the cryptographic API happens to support. RFC 7515 says “it is an application decision which algorithms may be used in a given context” and says a successfully verified JWS must still be considered invalid if its algorithm is unacceptable to the application. RFC 7515, Section 5.2.
RFC 8725, the JWT Best Current Practice, says: “Each key MUST be used with exactly one algorithm, and this MUST be checked when the cryptographic operation is performed.” Although that normative wording addresses JWT libraries, the same key-to-algorithm discipline is important in a manual verifier. Configure the permitted algorithms and key associations in trusted application policy; do not derive them from an untrusted token header. See RFC 8725, Section 3.1.
Rank #3
Key discovery also needs a trust boundary. Do not blindly fetch a URL named in an untrusted header or trust an embedded key simply because it appears in the token. Header parameters such as jku, jwk, and kid can help identify keys, but provenance and issuer checks determine whether a key is trusted. When an iss claim is present, validate that the keys used belong to that issuer, as described in RFC 8725.
Understand who holds the signing-capable key
| Approach | Verification key | Trust implication |
|---|---|---|
| HMAC, such as HS256 | The shared secret used to create the MAC | Every holder of the secret can also create a valid MAC; keep it secret and do not use a human-memorable password directly as the key. |
| Asymmetric signature, such as RS256 or ES256 | The public key corresponding to the signer’s private key | The signer uses the private key; verifiers need a trusted way to obtain and associate the public key with the expected issuer. |
Neither approach is universally preferable: choose according to the application’s trust model and explicit algorithm policy. RFC 8725 discusses attacks involving none, RS256-to-HS256 algorithm confusion, and inadequate HMAC keys, and advises against using human-memorable passwords directly as HS256 keys. See RFC 8725, Sections 2–3.
Account for algorithm-specific signature formats
There is no single signature representation that every JWS algorithm and low-level API uses unchanged. For example, RFC 7515’s appendices show HMAC-SHA-256 and RSA PKCS#1 v1.5 with SHA-256 verification. For ES256, a JWS signature is a 64-octet concatenation of 32-octet R and S values. Some cryptographic APIs expect ECDSA signatures in a different encoding, so conversion may be necessary; it must be implemented and validated carefully rather than assumed to work automatically. Consult the API’s documented format and the JWS requirements in RFC 7515, Appendices A.1–A.3.
Be strict about encoding too. RFC 7515 rejects Base64url encodings whose length modulo four is one; do not silently accept arbitrary whitespace or extra characters in compact segments. JOSE header and JWT claim JSON must use UTF-8, not another Unicode encoding. See RFC 7515 and RFC 8725, Section 3.7.
What a successful signature check does—and does not—prove
A successful check establishes that the signature or MAC matches the exact signing input under the key and algorithm used. It does not by itself establish that the key belongs to the issuer your application expects, that the token is intended for your audience, that its time claims are acceptable, or that the token is being used for the right purpose. Make those decisions under application policy after cryptographic verification; RFC 8725 specifically calls for validating the association between an issuer and its keys when iss is present.
Failures that commonly make manual verification unsafe
- Accepting
alg: nonein a flow that requires a signature. - Allowing the token’s
algto select any operation supported by the implementation. - Using an RSA public key as an HMAC secret, creating an algorithm-confusion vulnerability.
- Using a human-memorable password directly as an HS256 key.
- Decoding and reserializing the JSON before computing the signing input.
- Trusting
kid,jku, or an embedded JWK without checking key provenance and issuer association. - Accepting the token based on its signature alone, without claim and purpose validation.
- Checking only one operation in a nested JWT when the construction requires both outer and inner cryptographic operations to validate.
RFC 8725 requires rejection if a required cryptographic operation fails and documents the algorithm-confusion and weak-key hazards. A manual verifier should reject malformed input or any unsupported condition rather than fall back to a different interpretation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
