Skip to content

JWT Builder & Signer

Build compact JWTs from editable Header and Payload JSON, then sign and self-check them locally with HMAC, RSA, RSA-PSS, or ECDSA.

Local input limit: 2 MB · Processing timeout: 120 s
How can I verify this?

Open your browser DevTools and the Network panel, optionally clear existing requests, then run the tool. Page assets or consent-based analytics may still load, but tool payloads, files, keys, and results are not sent for processing.

Build and sign a JWT

Edit the protected Header and Payload JSON, choose a reviewed JWS algorithm, and supply signing material. The selected algorithm replaces header.alg before signing.

JOSE Header JSON

JWT Payload JSON

0 KB

Use a secret at least as long as the selected hash output. The secret remains in component and worker memory only.

Signed JWT

Ready to create a compact JWT

Add signing material and sign. The token, segment sizes, key metadata, warnings, and local self-check will appear here.

Create reproducible compact JWT signatures locally

DecodeLens serializes the edited JSON, applies the selected JOSE alg value, signs the exact compact Header.Payload bytes with Web Crypto, and immediately verifies the generated signature before showing the token.

Signing and trust boundaries

  • Supports HS, RS, PS, and ES SHA-2 JWS algorithms; alg=none and remote key lookup are intentionally unavailable.
  • Asymmetric signing accepts unencrypted PKCS#8 PEM or private JWK only.
  • A self-verified signature does not establish issuer identity, claim validity, audience acceptance, or authorization.

Related tools for this workflow

Continue with tools that decode, convert, inspect, or verify the same data.