JWT sign & verify

Client

Create or verify HMAC-signed JSON Web Tokens (HS256, HS384, HS512) in your browser. For read-only claim inspection, use JWT decode.

Use HMAC only when both sides share a secret

HS256, HS384, and HS512 authenticate a token with the same secret on the signer and verifier. They are useful for controlled integrations and test fixtures, but they are not interchangeable with RS256 or ES256 public-key workflows.

For asymmetric tokens, use JWT sign with PEM and JWT verify with PEM so a private signing key does not have to be distributed to every verifier.

A valid signature is only the first check

Verification confirms that the compact token has not changed and matches the supplied secret. An application must still enforce the expected issuer, audience, algorithm, expiry, not-before time, and any authorization claims.

Use short-lived test claims and throwaway secrets on this page. Do not place production tokens or shared secrets in URLs, screenshots, tickets, or chat transcripts.

HMAC only: HS256, HS384, and HS512 run in your browser with Web Crypto. RS256/ES256 are not supported here—use your backend or a PEM workflow. To read claims without verifying, use JWT decode.

Sign JWT

Header (JSON)

Payload (JSON)

?

The alg field in the signed header is set from your algorithm choice. Secret and JSON never leave this tab.

Nearby workflows on Toolcore

Common use cases

  • Prototype OAuth or API gateways with HS256 test tokens before wiring your auth service.
  • Confirm a shared secret still matches a token signature during integration debugging.
  • Generate signed JWTs for local Postman or curl flows without installing CLI tools.

Common mistakes to avoid

  • Using this page for RS256 or ES256

    Only HMAC algorithms (HS256/384/512) are supported. Asymmetric keys need your backend or a PEM workflow.

  • Treating verify as authorization

    A valid signature only proves integrity with a secret you already trust—it does not replace issuer, audience, or expiry checks.

  • Pasting production secrets

    Use throwaway secrets in demos. Rotate credentials if a production secret was exposed.

FAQ

Which algorithms are supported?

HS256, HS384, and HS512 using Web Crypto HMAC. The alg field in the signed header matches your selection.

How is this different from JWT decode?

Decode only reads header and payload. This page signs new tokens or verifies that the signature matches your HMAC secret.

Is my secret sent to Toolcore?

No. Signing and verification run entirely in your browser tab.

Common search terms

Phrases people search for that match this tool. See the full long-tail keyword index.

  • jwt sign online hs256
  • create jwt token hmac browser
  • jwt sign and verify online
  • generate jwt with secret local

More tools

Related utilities you can open in another tab—mostly client-side.