JOSE & JWT
Sign, decode and verify JSON Web Tokens, decrypt JWEs, read PASETO tokens, generate keys and convert them between JWK, PEM and SSH, and build or check the key sets behind them — with plain explanations of what is wrong.
9 tools
JWT ES256 Debugger
Decode & verify ES256/ES384/ES512 tokens
Decode a JWT, inspect header and claims, verify ECDSA-signed tokens (ES256, ES384, ES512) against a public key, and get a plain-English explanation of what is wrong.
Open toolJWKS & OIDC Checker
Check the key set behind your tokens
Enter a JWKS URL, an OpenID configuration or just the issuer domain — the checker fetches what your provider actually serves and reports key sizes, kid coverage, duplicate identifiers, expired certificates, private material published by mistake, and the algorithms advertised.
Open toolJWT Signer
Sign tokens with your own key
Build a JWT from a header and claims, set iat, nbf and exp with relative times, and sign it with any JOSE algorithm — HMAC, RSA, RSA-PSS, ECDSA or EdDSA. The key stays in your browser.
Open toolKey Generator
New key pairs as JWK, PEM and SSH
Create EC, Ed25519, X25519 and RSA key pairs or symmetric secrets in your browser and get them as JWK, PEM, OpenSSH and raw bytes, with the RFC 7638 thumbprint as kid.
Open toolJWK Converter
JWK ⇄ PEM ⇄ OpenSSH ⇄ hex
Paste a key in any form — JWK, PEM, a certificate, OpenSSH or raw hex — and get it in every other form, with its RFC 7638 thumbprint and the algorithms it suits. Conversion runs in your browser.
Open toolJWKS Builder
Build and check a JSON Web Key Set
Turn PEM public keys, certificates and JWKs into a JSON Web Key Set with RFC 7638 kids and x5c chains, or paste a set to check it for leaked private keys, duplicate kids and mixed use.
Open toolJWE Inspector
Decode and decrypt JWE tokens
Paste an encrypted JWT or any JWE — compact or JSON — to read its header and structure, then decrypt it with your private key, shared key or password. Decryption runs in your browser.
Open toolHMAC Calculator
HMAC, SHA-2, SHA-3 and MD5
Compute an HMAC over SHA-1, SHA-2 or SHA-3, or every common digest of a message at once, check an expected MAC in constant time and compare two values safely. Runs in your browser.
Open toolPASETO Decoder
Decode and verify PASETO tokens
Paste a PASETO token to read its version, purpose, claims and footer, and verify a v4.public or v3.public signature with the issuer’s public key. Runs entirely in your browser.
Open tool