JWT Encoder API

Sign a JWT (HS256/384/512 with a shared secret, or RS/PS/ES with a PEM private key), or verify a token's signature and exp/nbf/iat claims.

Create and sign JSON Web Tokens with HS256, RS256, PS256 or ES256, add iat and exp in one click, and verify a token's signature and expiry. Runs in your browser.

Input

Send these as a JSON object. Unknown fields are rejected.

mode

sign: build and sign a token from header and payload. verify: check token's signature and time claims. (string, one of sign, verify, default "sign")

alg

Signing algorithm. HS* use a shared secret; RS*/PS* need an RSA key; ES256/ES384 an EC P-256/P-384 key. (string, one of HS256, HS384, HS512, RS256, RS384, RS512, PS256, ES256, ES384, default "HS256")

key

HS*: the shared secret. Otherwise a PEM key: PKCS#8 PRIVATE KEY to sign, SPKI PUBLIC KEY to verify. (string, up to 20000 characters, required)

keyEncoding

How an HS* secret is written: text (UTF-8) or base64. (string, one of text, base64, default "text")

payload

Sign: the claims as a JSON object, e.g. {"sub":"123","iat":1700000000}. (string, default "{}")

header

Sign: extra header fields as a JSON object; alg is always set from "alg". (string, default "{\"typ\":\"JWT\"}")

token

Verify: the compact JWT to check. (string, up to 20000 characters)

now

Verify: Unix time in seconds to check exp/nbf/iat against. Defaults to now. (number, 0 to …)

skew

Verify: allowed clock difference in seconds. (integer, 0 to 86400, default 0)