Question 1

What is JWT signing?

Accepted Answer

JWT signing creates a tamper-proof token by computing a cryptographic signature over the header and payload. The signature is generated using a secret (HMAC) or a private key (RSA/ECDSA) so receivers can verify the token has not been modified.

Question 2

Is the secret sent to a server?

Accepted Answer

No. All JWT signing happens entirely in your browser using the Web Crypto API. The secret key never leaves your computer.

Question 3

Which algorithms are supported?

Accepted Answer

This tool supports HMAC-based signing with HS256, HS384 and HS512. These are the most common symmetric algorithms used for API tokens, sessions and webhooks.

Question 4

What is the difference between JWT signing and JWT decoding?

Accepted Answer

Decoding reads and displays the contents of a token without verifying it. Signing creates a new token from your header, payload and secret, producing a valid string you can send to clients or APIs.