How to Use the JWT Signer, Verifier & Secret Inspector
-
1
Choose 'Verify Token' to check an existing JWT or 'Sign New Token' to construct a signed payload.
-
2
In Verify mode: Paste the encoded JWT and enter your signing secret key to test signature validity.
-
3
In Sign mode: Customize Header and Payload JSON claims, choose an expiration preset (+1h, +24h, +7d), and enter your secret key.
-
4
Click 'Verify Signature' or 'Sign & Generate JWT' to execute native Web Crypto HMAC-SHA256 calculations.
-
5
Copy the formatted decoded claims or signed production JWT.
Practical Example & Use Case
Verifying that a webhook authorization JWT received from an authentication provider was genuinely signed with the application secret key and has not expired.
Technical Notes & Limitations
Executes 100% locally via the browser's native `window.crypto.subtle` API. Supports symmetric HMAC SHA-256 (HS256). Secrets are never transmitted across the network.
Frequently Asked Questions
Is it safe to paste production JWT secret keys into this tool?
Yes. This tool runs 100% client-side with zero external API calls or telemetry. The Web Crypto API processes cryptographic signing completely inside your local browser memory.
What does a signature mismatch mean?
A signature mismatch indicates that either the secret key entered is incorrect, or the header/payload content was modified in transit after signing.
How are Unix timestamps calculated for expiration?
The `iat` (issued at) and `exp` (expiration) claims are stored as seconds since the Unix epoch (January 1, 1970 UTC).