title: How to verify a HS256 signed JWT Token created with Keycloak authentication provider on jwt.io
body: <p>I am trying to verify a HS256 JWT Token generated with locally ran <a href="https://www.keycloak.org/" rel="noreferrer">KeyCloak</a> Authentication Provider on <a href="https://jwt.io" rel="noreferrer">https://jwt.io</a>. </p>
  
  <p>The KeyCloack instance is running on my local machine inside a docker container. I have applied almost the same steps as described in this answer (which on contrary applies the RS algorithm instead, and works as described): <a href="https://stackoverflow.com/a/55002225/1534753">https://stackoverflow.com/a/55002225/1534753</a></p>
  
  <p>My validation procedure is very simple:</p>
  
  <p>1.) Request the token (with Postman) from my local docker KeyCloak instance with:
   POST requesting <a href="http://localhost:8080/auth/realms/dev/protocol/openid-connect/token" rel="noreferrer">http://localhost:8080/auth/realms/dev/protocol/openid-connect/token</a></p>
  
  <p>2.) Copy the token contents inside the jwt.io's "Encoded" section</p>
  
  <p>3.) I verify that the header and payload are as expected and correct</p>
  
  <p>4.) I copy the client secret from my KeyCloak instance admin dashboard, you can see the reference on the image below:</p>
  
  <p><a href="https://i.stack.imgur.com/LteGJ.png" rel="noreferrer"><img src="https://i.stack.imgur.com/LteGJ.png" alt="enter image description here"></a></p>
  
  <p>5.) I paste the secret into the "VERIFY SIGNATURE" section on jwt.io and the "Encoded" token section changes, hence resulting with an invalid signature and a invalid (i.e. different) token.</p>
  
  <p><strong>My core question is what am I missing here? Why does the token change when I apply the expected secret!?</strong> Am I applying the right secret, the one from the client? If I understand JWT infrastructre and standard correctly then It should stay the same if the secret (with the expected algorithm applied) is valid. My reasoning is that something with JWT creation on KeyCloak is specific. I have not touched the HS256 algorithm provider on KeyCloak, everything is used as default with the docker installation guide on using KeyCloak. The settings related to the token and algorithm are setup to use HS256, and the algorithm is specified as expected in the JWT's header section correctly which can be verified after the encoded token is pasted into the jwt.io's page.</p>
  
  <p>I need this to work as I am trying to apply the same JWT validation process inside a .NET Core web API application. I have encountered this whole issue in there, i.e. inside the <code>System.IdentityModel.Tokens.JWT</code> and the <code>JwtSecurityTokenHandle.ValidateSignature</code> method which results with an invalid signature and finally resulting in an exception. </p>
  
  <p>On side note, I am accessing the token with Postman and its Authorize feature the configuration can be seen on the image below:</p>
  
  <p><a href="https://i.stack.imgur.com/UqFra.png" rel="noreferrer"><img src="https://i.stack.imgur.com/UqFra.png" alt="enter image description here"></a></p>
  
  <p>One more side note is I have a user "John" which belongs to my "Demo" realm. I use him to request an access token from KeyCloak.</p>