For asymmetric algorithms (RS256, ES256, EdDSA), you don’t need the secret — you need the public key. Fetch the issuer’s JWKS (https://issuer/.well-known/jwks.json), match the JWT header’s kid field to the corresponding JWK, use that public key to verify. For symmetric algorithms (HS256, HS512), you need the shared secret — there’s no verification without it. If you’re just inspecting a JWT (not verifying), the JWT decoder shows header and payload without any key material. Never trust decoded contents without also verifying the signature in production.
All questions
How do I verify a JWT signature without the secret?
Read the full guide
What Is a JWT?
JWT (JSON Web Token) is the dominant format for API authentication, OAuth access tokens, and stateless session management. Three base64-encoded segments carry the header, claims, and signature — anyone can read them, but only the key holder can produce a valid token.