/web local tool
JWT Lab
Verify HS256, RS256 or ES256 with supplied keys, or create labeled HS256 test tokens.
Local execution receiptinput path disclosedTool content stays out of MonoTools URLs and API requests.
- Working input
- Browser memory
- Cross-tool handoff
- Session only · 10 min
- URL payload
- Never
- Export
- Explicit action
Verify it: open DevTools Network, clear the log, use the tool, then inspect fetch/XHR requests. Page assets and optional aggregate analytics may use the network; tool input is not included.
Full privacy modelLoading tool...
01
How to use
- 01Start in Inspect only, or load a safe valid, expired, not-yet-valid or alg=none scenario.
- 02Choose the explicit HS256 or public-key workflow, lock the expected algorithm, then provide the local verification material.
- 03Review issuer, audience and time claims independently, then copy or download the local report.
02
FAQ
- Should I paste production secrets here?
- Inputs stay in the current tab and are not stored or added to URLs, but production secrets should still follow your team's handling policy. Prefer non-production test material.
- Which algorithms are supported?
- HS256 signing and verification are available for development fixtures. RS256 and ES256 verification accept a public JWK, local JWKS or SPKI PEM file. Private keys and remote JWKS fetching are intentionally excluded.
- Does a matching signature mean the JWT is safe to accept?
- No. Signature verification and configured claim checks are shown separately. Your application must still trust the issuer and key source, enforce audience and time claims, and apply authorization rules.
guides
Guides
03
Related tools
- →/webJWT DecoderDecode JWT structure and claims without implying trust.
- →/cryptoSecret ScannerFind and redact secrets before sharing text.
- →/timeUnix Timestamp ConverterConvert timestamps with timezone and DST diagnostics.
- →/encodingBase64 Encoder / DecoderEncode, decode and inspect Base64, Data URLs and binary files.