JWT Signer & Verifier
Digital SignaturesProcessed locally in your browser using the Web Crypto API. Nothing is sent to any server.
How It Works
This tool has two modes. Sign creates a JWT from a payload JSON and your secret or private key. Parse & Verify splits the three base64url-encoded segments, decodes the header and payload as JSON, and verifies the signature using either HMAC (shared secret) or RSA/ECDSA (public key).
Supported Algorithms
- HS256/384/512: HMAC — symmetric signing with a shared secret
- RS256/384/512: RSASSA-PKCS1-v1_5 — asymmetric RSA signatures
- PS256/384/512: RSA-PSS — probabilistic RSA signatures (recommended over RS)
- ES256/384/512: ECDSA — compact elliptic-curve signatures (P-256/P-384/P-521)
How JWT Works
- The server creates a token:
base64url(header) + "." + base64url(payload) + "." + signature - The signature is computed over
header.payloadusing the specified algorithm - The client receives the token and can decode the header and payload (they are base64, not encrypted)
- To verify authenticity, the signature is recomputed and compared to the provided one
- The
expclaim in the payload indicates when the token expires
Common Use Cases
- Debug authentication issues in API development
- Create test tokens to exercise your API's auth flow locally
- Verify that tokens issued by your server have correct claims
- Inspect token expiration and issuer information
- Educational — understand how JWT authentication works under the hood
Frequently Asked Questions
What is a JWT?
JWT (JSON Web Token) is a compact token format with three parts: Header (algorithm), Payload (claims/data), and Signature (cryptographic proof). It is widely used for authentication and information exchange.
How does JWT signature verification work?
Verification recomputes the signature from the header and payload using the specified algorithm and a key, then compares it to the provided signature. For HMAC, a shared secret is used. For RSA, a public key is used.
Is the payload encrypted?
No. JWT payload is base64url-encoded, not encrypted. Anyone who has the token can read its contents. The signature only guarantees authenticity and integrity, not confidentiality. Never put sensitive data in a JWT payload.
Can I create (sign) a JWT?
Yes. Switch to the Sign mode, edit the payload JSON, choose an algorithm (HS/RS/PS/ES family), and provide the shared secret or PKCS#8 private key. Signing happens entirely in your browser — your keys never leave your device.
Privacy Note
This tool runs entirely in your browser. Your input is never uploaded, stored, or sent to any server.
Disclaimer: This tool is provided for educational and informational purposes only. The results do not constitute professional security advice. Use at your own discretion.