JWS Sign & Verify
Local processingDecoded claims are untrusted
A valid signature does not validate claims. Use only expected algorithms and trusted keys; validate issuer, audience, expiry and purpose in your application.
Sign
Verify
Algorithm
HS256 (HMAC SHA-256)
Payload (JSON)
Secret KeyHMAC secrets need at least 32, 48 or 64 UTF-8 bytes for HS256, HS384 or HS512. Use a random secret; the example is public.
Standards, sources and review dates
- JWT security BCP · RFC 8725 · February 2020 · Reviewed
Decoding does not verify authenticity. Verification must constrain algorithms, keys, issuer, audience, token purpose and time claims. Review interval: 90 days.
- JSON Web Algorithms · RFC 7518 · May 2015 · Reviewed
JWE GCM and CBC-HMAC, direct keys and AES-KW; JWS key sizes and JWK algorithm metadata. Published vectors cover supported modes. Review interval: 180 days.
- JSON Web Signature · RFC 7515 · May 2015 · Reviewed
UTF-8 compact signatures with an explicitly selected algorithm. Signature checks do not validate application claims. Review interval: 180 days.