JWT Signer & Verifier — HS256 / HS384 / HS512

Payload (JSON)

Secret

Algorithm

About JSON Web Tokens

A JWT is a small, signed token that carries a set of claims — typically used to prove a user's identity after they sign in. It is made of three dot-separated parts: a header that names the algorithm, a payload that holds the claims, and a signature that ties the two to a secret. If the header or payload is changed, the signature no longer matches and verification fails.

This tool works with the HMAC family — HS256, HS384, and HS512 — where a single shared secret both signs and verifies. That makes it ideal for services under your own control that already share a secret. Use Sign to turn a JSON payload into a token, and Verify to check a token against a secret and see its decoded header and payload, including whether it has expired.

Because the whole process uses your browser's built-in cryptography, your secret and your tokens never leave your device — nothing is uploaded and nothing is stored. That privacy is the point: you can inspect and issue tokens without trusting a remote service with your keys.

How it works

Three steps. No sign-up, no upload, no wait.

Pick a mode

Sign a new token from a JSON payload, or verify and decode a token you already have.

Add your secret

Enter the shared HMAC secret. It stays on your device — nothing is ever uploaded.

Sign or verify

Get the signed token to copy, or a clear valid / failed result with the decoded header and payload.

🔒

Private by design.Everything happens right here in your browser. Your files are never uploaded — we never see them.

Frequently Asked Questions

What is a JWT? ▼

A JSON Web Token is a compact, signed token used to carry claims between systems — most often to prove who a user is after they log in. It has three parts separated by dots: a header, a payload, and a signature. The signature lets the receiver confirm the token has not been tampered with.

What goes in the header, payload, and signature? ▼

The header names the signing algorithm and token type. The payload holds the claims — data such as a user id, an expiry time (exp), or a not-before time (nbf). The signature is computed from the header, the payload, and the secret, so any change to the first two invalidates it.

What is the difference between HS256, HS384, and HS512? ▼

All three are HMAC algorithms that sign and verify with a single shared secret; they differ only in the SHA-2 hash used — SHA-256, SHA-384, or SHA-512. HS256 is the common default and is plenty for most uses; HS384 and HS512 produce longer signatures and are worth choosing when your policy calls for a stronger hash.

Does my secret or token leave my browser? ▼

No. All signing and verifying happens on your device using the browser's built-in Web Crypto API. Your secret, payload, and tokens are never sent to a server — that on-device guarantee is the whole point of this tool.

The token says invalid — what does that mean? ▼

A failed check usually means the secret does not match the one used to sign the token, or the token was altered. This tool also flags a signed token as expired (past its exp) or not yet valid (before its nbf), while still showing you the decoded header and payload.