JWT & OAuth Security Toolkit

Decode, sign, and verify JSON Web Tokens (HS256/384/512, RS256, ES256) and generate OAuth PKCE code_challenges and authorization URLs. Everything runs 100% in your browser.

Sign and verify JWTs (HS256/384/512, RS256, ES256).
Generate PKCE code_verifier and code_challenge.
Build OAuth authorization URLs for debugging flows.

Quick examples

No data leaves your browser.

JWT Decode

Token input

Header

Payload

Signature (base64url)

JWT Sign

Header JSON

Payload JSON

Signing settings

Algorithm Key format

Shared secret (HS*)

Private key (RS256/ES256)

PEM support: BEGIN PRIVATE KEY (PKCS8) and BEGIN PUBLIC KEY (SPKI) only.

Signed JWT

JWT Verify

Verification settings

JWT

Algorithm Key format Clock skew (seconds)

Shared secret (HS*)

Public key (RS256/ES256)

PEM support: BEGIN PUBLIC KEY (SPKI) only.

Asymmetric Key Helper (RS256 / ES256)

Generate JWK keypairs

Private JWK

Public JWK

OAuth PKCE Helper

Code verifier + challenge

code_verifier

Length

code_challenge_method

code_challenge

Authorization URL Builder

Build OAuth authorize URL (response_type=code)

authorization_endpoint

client_id

redirect_uri

scope

state

code_challenge

code_challenge_method

Authorization URL