JWT RS256 and ES256 Signer
Sign a JWT with RS256, RS512, PS256, ES256, ES384 or EdDSA using a private key in your browser, verify a token with a public key, and get the JWKS to publish.
Free · No sign-up · Your inputs stay in your browser
Input
Sign and verify JWTs with RSA, ECDSA or EdDSA
Output
Generate or paste a key
Asymmetric JWTs let any service verify a token with the public key while only the issuer holds the private one, which is why identity providers publish a JWKS rather than share a secret. Pin the algorithm on the verifying side: libraries that read alg from the token have accepted none and HS256-with-the-public-key forgeries. Ed25519 needs a recent browser.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Asymmetric tokens
With HS256 every service that verifies a token holds the secret that can mint one. With RS256 or ES256 only the issuer holds the private key, and any service can verify with the public key, fetched from a JWKS endpoint that lets keys rotate by kid. The algorithms are registered in RFC 7518 and EdDSA in RFC 8037.
Pin the algorithm
Verifiers that trust the alg in the token header have accepted alg none, and HS256 tokens signed with the public key as an HMAC secret. Always tell the library which algorithm to expect.