Free, browser-based utilities for everyday developer workflows

JWT & OAuth Security Toolkit

Decode, sign, and verify JSON Web Tokens (HS256/384/512, RS256, ES256) and generate OAuth PKCE code_challenges and authorization URLs. Everything runs 100% in your browser.

  • Sign and verify JWTs (HS256/384/512, RS256, ES256).
  • Generate PKCE code_verifier and code_challenge.
  • Build OAuth authorization URLs for debugging flows.

Use cases

Verify a JWT Signature

Explore more in the Use cases library.

Quick examples

No data leaves your browser.
JWT Decode

Token input

Header

Payload

Signature (base64url)

JWT Sign

Header JSON

Payload JSON

Signing settings

PEM support: BEGIN PRIVATE KEY (PKCS8) and BEGIN PUBLIC KEY (SPKI) only.
JWT Verify

Verification settings

PEM support: BEGIN PUBLIC KEY (SPKI) only.
Asymmetric Key Helper (RS256 / ES256)

Generate JWK keypairs

OAuth PKCE Helper

Code verifier + challenge

Authorization URL Builder

Build OAuth authorize URL (response_type=code)

How to use JWT & OAuth Security Toolkit

Use the sign tab to generate a signed JWT using HS256, RS256, or ES256 with your chosen payload and key. Use the verify tab to validate a token signature, or use the PKCE tab to generate a code verifier and challenge pair for OAuth 2.0 flows.

Common use cases

Security engineers use this to prototype and test custom JWT signing and verification flows. OAuth developers use it to generate valid PKCE pairs for authorisation code flows during local testing, and QA teams use it to reproduce token-related authentication bugs.

Why run this in your browser?

All processing happens locally in your browser. Your data never leaves your machine, making it safe for sensitive payloads, internal API responses, and confidential configurations.