Developer tools
JWT Signature Verifier & Signer

JWT signature verifier and token signer

Verify whether a JWT signature is authentic or mint signed test tokens for local development using HS256, RS256, or ES256. Everything runs via your browser’s built-in WebCrypto API — your HMAC secrets and private keys never leave your device.

Open JWT Signature Verifier & Signer — free Get the Windows app

Free in your browser — no sign-up. Install from the Microsoft Store to use it offline on Windows 10 and 11.

How to use it

Open the JWT Toolkit and paste your token.
Enter the HMAC secret (for HS256) or PEM public key (for RS256/ES256) and press Verify signature.
To create a token, switch to the Sign tab, edit the JSON claims, and sign with your secret or generated key pair.

Example

Algorithm & Claims

Algorithm: HS256
Secret:    my-local-dev-secret
Payload:   {"sub": "usr_123", "role": "admin"}

Verification result

Signature VALID (HS256 verified locally via WebCrypto)

Features

HS256, RS256, and ES256 verification — cryptographic verification using native WebCrypto. PRO
Sign test JWTs — customize headers, payloads, and expiration times for integration tests. PRO
Key-pair generator — generate fresh RSA-2048 or ECDSA P-256 PEM key pairs in one click. PRO

Frequently asked questions

Is it safe to paste my HMAC secret or PEM key?

Yes. Signature verification and signing run 100% locally via the browser’s SubtleCrypto API. Keys are never sent over the network.

Can I decode a JWT without the secret?

Yes, decoding the header and payload is free and does not require the key. You only need the secret or public key to verify the signature.

One workspace for all of it

JWT Signature Verifier & Signer is one of 18 developer tools in CodeForge — alongside a JSON formatter, JWT decoder, regex tester, UUID and hash generators, and more. Press Ctrl+K to jump to any of them.