Decode, edit, and re-sign JSON Web Tokens live. Edit the encoded token on the left or the header and payload on the right — valid JSON edits update the other side instantly. Edits re-sign with the current key when possible; without a signing key, the existing signature is retained. Changing a key only re-checks the signature; press Update encoded token to re-sign with it. Signs and verifies HMAC ( HS256 ), RSA (RS/PS), ECDSA (ES) and EdDSA, with PEM or JWK keys, entirely in your browser.
Paste an oct JWK to use a raw/binary key — its base64url k value is decoded to the exact secret bytes (text secrets keep working as before).
HS256/384/512) sign with a shared secret. A short or dictionary-word secret can be cracked offline in seconds — use a long, random secret (32+ bytes) and never commit it to source control.