What JWT Sign & Verify does
Decoding a JWT only reveals its claims; signature verification establishes that it was produced by a party holding trusted key material. This tool pins the selected algorithm, rejects none and mismatches, and separates cryptographic validity from time-claim status.
Common uses
- Generate HS256 or RS256 test tokens for integration work
- Verify a signature with a shared secret or RSA public key
- Debug algorithm, exp, nbf, and PEM-format failures
Privacy and limitations
Tokens, secrets, PEM keys, JWK, and JWKS data are passed only to the browser Web Crypto API. The tool does not fetch a remote JWKS URL. Production private keys should remain in a KMS, HSM, or controlled offline environment.
Always validate security-sensitive output in the authoritative application or platform.
Frequently asked questions
Which key formats are accepted?
HS256 uses a text secret. RS256 signing accepts a PKCS#8 PRIVATE KEY; verification accepts an SPKI PUBLIC KEY.
Does a valid signature mean the token is acceptable?
No. An application must also validate issuer, audience, subject, exp, nbf, and its own authorization rules.
Why is alg=none unsupported?
An unsigned token cannot establish its origin. The tool rejects none and requires the header algorithm to exactly match the selected algorithm.