JWTStudio

Decode, verify, and create JWT tokens — entirely in your browser.

Tokens and secrets are processed locally and never stored or sent to any server — unlike online JWT sites, there is no backend here at all

JWT token

Payload (JSON)

{
  "sub": "1234567890",
  "name": "John Doe",
  "iat": 1516239022
}

Algorithm

Private key (PEM, PKCS#8)

Only use TEST keys here. Signing happens locally via WebCrypto, but production private keys should never be pasted into any browser tool. The generated keypair's public key appears below so you can verify elsewhere.

Signed token

Signed with WebCrypto in this tab (HMAC, RSA, or ECDSA). The secret never leaves your machine — but only sign with test/dev secrets in any browser tool, including this one.

Header

Payload

Claims explained

Claim	Value	Meaning

Signature

Verify signature

Verified locally with WebCrypto — the secret or public key never leaves this page. RSA and ECDSA tokens verify with the public key, which is safe to paste anywhere; a private key never is, in this tool or any other.