JWT & OAuth Security Toolkit
Pick a mode: Verify a JWT against a secret / public key, Sign a payload, generate an OAuth 2.0 PKCE pair, validate an OAuth callback URL, or inspect an OIDC discovery document. Signing keys and HMAC secrets never leave your browser — all crypto runs locally via Web Crypto. For read-only token inspection, use the JWT Decoder.
Auto-runs as you type. Ctrl+Enter to re-run. Decode-only? Use the JWT Decoder.
How to use the JWT & OAuth Security Toolkit
Sign and verify JSON Web Tokens with the algorithms most services use: HS256 / HS384 / HS512 (HMAC), RS256 (RSA), and ES256 (ECDSA). Generate OAuth 2.0 PKCE code verifier / challenge pairs (S256) for SPA, mobile, and CLI flows, validate an OAuth callback URL, and inspect an OIDC discovery document. Signing keys and HMAC secrets never leave your browser — all crypto runs locally via Web Crypto. Use this to debug login failures, test new auth integrations, and verify what your backend really expects. For plain read-only decoding, use the JWT Decoder.
What it does
- Verify JWT signatures against a secret (HS256/384/512) or public key (RS256 / ES256), and check
exp,nbf,iatwith a configurable clock skew. - Sign JWTs with HS256/384/512, RS256, or ES256 from a payload JSON and a secret / private key.
- Generate OAuth 2.0 PKCE code verifier and S256 code challenge.
- Validate an OAuth callback URL: flow detection,
state(CSRF) presence, and error parameters. - Inspect an OIDC discovery document for required endpoints and metadata.
- Hand off to the JWT Decoder for read-only inspection or the JWK / JWKS / PEM Converter for key conversion.
When to use it
- Confirm your auth service signs tokens with the configured secret or key.
- Verify a token against a known shared secret or public key while debugging a 401.
- Generate a PKCE verifier / challenge pair for a SPA, mobile, or CLI OAuth flow.
- Check that an OAuth callback carries
stateand the expected flow parameters. - Spot algorithm-confusion or downgrade risks (HS256 + asymmetric key).
- Reproduce a production token locally to debug a claim mismatch.
How to use it
- Pick the mode (Verify, Sign, PKCE, OAuth callback, or OIDC discovery).
- For Verify / Sign, pick the algorithm and provide the HMAC secret (HS) or the key (RS / ES) in PEM or JWK form in the second input.
- Paste the token (Verify), payload JSON (Sign), callback URL, or discovery JSON into the main input.
- Read the verdict, then open the Details and Findings tabs.
- For OAuth flows, switch the mode to PKCE to generate a verifier / challenge pair.
- Inspect existing tokens with the JWT Decoder; convert public keys with the JWK / JWKS / PEM Converter.
Tips & pitfalls
- HS256 uses the same secret for signing and verifying — anyone with the secret can mint tokens. Treat it as a credential.
- Algorithm confusion: never allow the verifier to use a different algorithm than expected. A common attack swaps RS256 for HS256 using the public key as the HMAC secret.
- Decoding is not verification. Always verify the signature against the trusted key before trusting any claim.
- The PKCE
code_challengeis S256 (SHA-256 of the verifier) — required by most modern providers;plainis deprecated. - Reject
alg=nonein your verifier — it is a historical foot-gun. - Set short
expvalues and requireaud/isschecks; do not rely on signature alone.
FAQ
- How do I sign a JWT in the browser? Switch to Sign mode, pick the algorithm, provide the secret or key, paste the payload JSON, and read the token.
- How do I verify a JWT against a public key? Use Verify mode, pick RS256 / ES256, paste the public key (PEM or JWK) in the key input, and the token in the main input.
- What is OAuth PKCE? Proof Key for Code Exchange — a mitigation for authorization-code interception in public clients. The verifier is random; the challenge is its SHA-256 hash, sent at /authorize.
- Are my keys uploaded? No. All signing, verification, and PKCE generation use Web Crypto in your browser.
- What algorithms are supported? HS256, HS384, HS512, RS256, and ES256.
- Should I use HS256 or RS256? HS256 for trusted services with a shared secret; RS256 / ES256 when multiple verifiers need to validate without holding the signing key.
Related tools
- JWT Decoder — read-only inspection with claims timeline and security review.
- JWK / JWKS / PEM Converter — convert public keys and compute kid values.
- Certificate & PEM Tools — inspect certificates and PEM bundles.
Runs locally in your browser via Web Crypto. No uploads. HMAC secrets and private keys never leave your machine.