Nothing leaves your browser. Tokens are signed and checked on this page with WebCrypto. Your header, payload, secret and tokens are never uploaded or saved. This tool is for testing authorization flows, so use throwaway secrets rather than production keys.
Algorithm & Secret
The header's alg follows the algorithm. The same secret signs and verifies.
RFC 7518 requires at least 32 bytes for HS256.
Header
A JSON object. Its alg must match the algorithm.
Payload
The claims, as a JSON object. Times are seconds since 1970.
Quick claims
Signed Token
Updates as you type. Copy it into your test client.
Signing...
Verify a Token
Checks a pasted token against the secret and encoding set in Algorithm & Secret. The algorithm comes from the token's header, and exp and nbf use this device's clock.
Paste a token above to check its signature and expiry.