Which algorithms are supported?

HMAC-based signing only: HS256, HS384, and HS512, selectable from the Algorithm dropdown. Asymmetric algorithms (RS256, ES256, etc.) are not supported.

Does my secret key ever leave the browser?

No. Signing and verification both run through the Web Crypto API in your browser's memory, the secret and claims are never transmitted to any server.

What does the verification badge mean?

Signature Verified (Active) means the HMAC signature matches and the token hasn't expired. Signature Valid (Expired) means the signature matches but the current time is past the exp claim. Invalid Signature means the signature doesn't match the secret.

What do the "+1 Hour Exp" and "+1 Day Exp" buttons do?

They set the payload's exp claim to the current Unix timestamp plus 3600 or 86400 seconds, then re-sign the token automatically.

Can I share a token without exposing it in plain chat?

The Share Link button compresses the payload into the URL hash fragment, which browsers never send to a server, so the link can be shared privately without the payload appearing in server logs.

JWT Signer & Verifier

Sign and verify HMAC JSON Web Tokens client-side via Web Crypto API. Your private keys and claims are processed 100% inside your browser memory.

Private by architecture: All processing is 100% client-side memory. Your data never leaves this browser tab.

Algorithm:

JWT Payload (JSON Claims)

0 charsPayload JSON

HMAC Secret Key Used to cryptographically sign and verify the signature

0 charsCompact JWT

Token Color Breakdown

. Payload (Claims) . HMAC Signature

About This Tool

This tool signs and re-verifies HMAC JSON Web Tokens entirely with the browser's Web Crypto API, paste claims, pick an algorithm and secret, and it produces a compact, correctly Base64Url-encoded token while checking the signature and exp claim against the same secret in real time.

It only covers HMAC algorithms (HS256/384/512); it doesn't sign with RSA or ECDSA key pairs. If you just need to inspect an existing token's claims without a secret, use the JWT Decoder instead.

Key Features

HMAC algorithm selector: HS256, HS384, or HS512, signed via Web Crypto's SubtleCrypto.
Live re-verification badge: reports Signature Verified (Active), Signature Valid (Expired), or Invalid Signature after every sign.
Expiration quick-set buttons: +1 Hour Exp and +1 Day Exp patch the exp claim and re-sign automatically.
Private share links: compresses the payload into a URL hash fragment, which never reaches a server.
Token color breakdown: header, payload, and signature segments are color-tagged to match the compact JWT output.

Example

Signing this payload with algorithm HS256 and secret your-256-bit-secret:

{
  "sub": "1234567890",
  "name": "John Doe",
  "role": "admin",
  "iat": 1798963200,
  "exp": 1798966800
}

produces a compact JWT, with the header, payload, and HMAC signature each Base64Url-encoded:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwicm9sZSI6ImFkbWluIiwiaWF0IjoxNzk4OTYzMjAwLCJleHAiOjE3OTg5NjY4MDB9.4z2f...signature

The badge above the output reports Signature Verified (Active) when the token you just signed is re-verified against the same secret and isn't past its exp claim.

FAQ

Which algorithms are supported?: HMAC-based signing only: HS256, HS384, and HS512, selectable from the Algorithm dropdown. Asymmetric algorithms (RS256, ES256, etc.) are not supported.
Does my secret key ever leave the browser?: No. Signing and verification both run through the Web Crypto API in your browser's memory; the secret and claims are never transmitted to any server.
What does the verification badge mean?: Signature Verified (Active) means the HMAC signature matches and the token hasn't expired. Signature Valid (Expired) means the signature matches but the current time is past the exp claim. Invalid Signature means the signature doesn't match the secret.
What do the "+1 Hour Exp" and "+1 Day Exp" buttons do?: They set the payload's exp claim to the current Unix timestamp plus 3600 or 86400 seconds, then re-sign the token automatically.
Can I share a token without exposing it in plain chat?: The Share Link button compresses the payload into the URL hash fragment, which browsers never send to a server, so the link can be shared privately without the payload appearing in server logs.