JWT Toolkit

Crypto & Security

Decode a JWT, verify its signature and claims, or sign a new one with your own key.

Computed locally · never uploaded

JWT

Pick an algorithm and supply the key used to verify the signature

Expected algorithm

Shared secret

HMAC uses the same key to sign and verify — keep it secret.

Result

Enter the JWT you want to verify.

Checks beyond the signature: validity is always checked; issuer and audience only when filled in

Expected issuer (iss)

Expected audience (aud)

Clock tolerance (seconds)

Pick an algorithm, then generate or paste the key used to sign

Signing algorithm

Shared secret

HMAC uses the same key to sign and verify — keep it secret.

The claims written into the token

iat and exp are written automatically by the switches below — no need to add them here.

Key ID (kid, optional)

Expires in

Issued at (iat)

Set to the current time

Signing uses the browser's built-in Web Crypto — your key never leaves the page.