What does it mean to "sign a JWT" and why does it matter?
A JWT has three parts: header, payload, signature. The first two are plain base64 (anyone can read them), the third is a cryptographic signature that proves no one tampered with the data along the way.
Here you sign a JWT or verify an existing signature. We support every standard algorithm: HS256/384/512 (symmetric, secret-based), RS256/384/512 (RSA), ES256/384/512 (ECDSA), PS256/384/512 (RSA-PSS).
Everything runs locally. Your secret or private key never leaves your browser. This is a different tool from the JWT Decoder (which only decodes, no signing).
How to use
- Sign mode: header JSON on the left, payload JSON on the right. Pick an algorithm from the first row of pills.
- HMAC (HS256/384/512): provide a shared secret (string), the same secret is used to verify later. Simplest setup, most APIs use HS256.
- Asymmetric (RS/ES/PS): paste a PEM private key (PKCS#8). You give the public key to consumers of the token. Safer because the token issuer does not know the consumer secrets.
- exp helper: adds an "expires in 1h/1d/30d" claim to the payload. A JWT without exp is dangerous (never expires).
- Verify mode: paste a JWT and the key/secret. Green check = all good. Red X = invalid signature, expired token, or another issue.
When to use it
Five common situations where you sign or verify a JWT:
- Creating a user session in your API. After login, generate a JWT with user_id, role, exp, sign with HS256 + secret.
- API key for a partner integration. Issue a long-lived JWT (exp = +1 year), the partner attaches it to every request.
- Password reset. Send an email with a link containing a JWT (exp = +1h, payload = user_id), user clicks, you verify.
- Webhook signatures. Your API signs the webhook payload, the partner verifies with a public key before trusting.
- Single Sign-On (SSO). An identity provider (Auth0, Okta) issues a JWT, every app in the organization verifies it with the public key.
To only decode a JWT (no signing), use the JWT Decoder. To generate a keypair for signing, use the JWT Keypair Generator.
Questions and answers
HS256 for simple cases (one API, one client). Shared secret, smaller tokens, faster verification. RS256 for many consumers or microservices: the server signs with a private key, every microservice verifies with the public key (published as JWKS). Standard in 2025 for API ecosystems.