Verify Command

The verify command validates JWT token signatures and optionally checks expiration claims.

Basic Usage

jwt-hack verify <TOKEN> [OPTIONS]

Secret-Based Verification (HMAC)

Verify HMAC-signed tokens with a shared secret:

# Verify HS256 token
jwt-hack verify eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.5mhBHqs5_DTLdINd9p5m7ZJ6XD0Xc55kIaCRY5r6HRA --secret=test

# Try different secrets
jwt-hack verify <TOKEN> --secret=secret123
jwt-hack verify <TOKEN> --secret=password

Key-Based Verification (RSA/ECDSA)

Verify asymmetric tokens using public keys:

# Verify RSA-signed token
jwt-hack verify <RSA_TOKEN> --private-key=public.pem

# Verify ECDSA-signed token
jwt-hack verify <ECDSA_TOKEN> --private-key=ec-public.pem

Expiration Validation

Check if the token has expired:

# Enable expiration validation
jwt-hack verify <TOKEN> --secret=test --validate-exp

With --validate-exp, the command will:

• Check the exp (expiration) claim
• Validate against current timestamp
• Report if the token is expired
• Show time remaining or time since expiration

Command Options

Required

• <TOKEN> - The JWT token to verify

Authentication Options

• --secret <SECRET> - Secret for HMAC token verification
• --private-key <PATH> - Path to public key file for RSA/ECDSA verification

Validation Options

• --validate-exp - Enable expiration time validation

Verification Results

The verify command reports whether the signature is valid:

Successful Verification

Token is valid.

Failed Verification

On failure, the command prints the error and a hint about the likely cause, e.g.:

Token is invalid.

or, when verification errors out:

JWT Verification Error: Invalid signature
This could be due to an incorrect secret or key.

Expiration Issues

With --validate-exp, an expired token surfaces an expiration error:

JWT Verification Error: Expired signature
The token has expired. Check the 'exp' claim.

Examples

Basic HMAC Verification

# Verify with correct secret
jwt-hack verify eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0In0.SIGNATURE --secret=correct-secret

# Try with wrong secret (will fail)
jwt-hack verify eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0In0.SIGNATURE --secret=wrong-secret

RSA Token Verification

# Verify RSA256 token with public key
jwt-hack verify <RSA_TOKEN> --private-key=rsa-public.pem

Complete Validation

# Verify signature and check expiration
jwt-hack verify <TOKEN> --secret=mysecret --validate-exp

Key File Requirements

For RSA/ECDSA Verification

You need the public key corresponding to the private key used for signing:

# Extract public key from private key
openssl rsa -in private.pem -pubout -out public.pem

# Use public key for verification
jwt-hack verify <TOKEN> --private-key=public.pem

Supported Public Key Formats

• X.509 SubjectPublicKeyInfo - -----BEGIN PUBLIC KEY-----
• PKCS#1 RSA Public Key - -----BEGIN RSA PUBLIC KEY-----

Security Testing

The verify command is useful for security testing:

Test Different Secrets

# Test common weak secrets
jwt-hack verify <TOKEN> --secret=secret
jwt-hack verify <TOKEN> --secret=password
jwt-hack verify <TOKEN> --secret=123456
jwt-hack verify <TOKEN> --secret=test

Algorithm Confusion Testing

# Test if RSA token accepts HMAC verification (algorithm confusion)
jwt-hack verify <RSA_TOKEN> --secret=<PUBLIC_KEY_CONTENT>

None Algorithm Testing

# Test unsigned tokens (none algorithm)
jwt-hack verify <NONE_TOKEN>

Scripting

The verify command does not currently signal validity through distinct exit codes — an invalid signature is reported in the output but still exits 0. For reliable scripting, use the global --json flag and parse the valid field:

jwt-hack --json verify "$TOKEN" --secret="$SECRET"
# => {"success":true,"valid":true,"validate_exp":false}

if [ "$(jwt-hack --json verify "$TOKEN" --secret="$SECRET" | jq -r .valid)" = "true" ]; then
    echo "Token is valid"
else
    echo "Token verification failed"
fi