JWT decoder, verifier and signer
Paste a token to read it. Add the secret, a PEM public key or a JWKS to check its signature. The algorithm comes from the key, never from the token, so alg: none and public-key-as-HMAC-secret tricks are refused rather than "verified".
Using this from the terminal
Every tool here also answers a plain POST with JSON. From a terminal your input goes to this server, unlike on the page, which runs everything in your browser.
curl https://cipher.corpberry.com/jwt/decode -d token=eyJ… -d key=secret
curl https://cipher.corpberry.com/jwt/sign -d alg=HS256 -d key=secret -d exp=1h --data-urlencode 'payload={"sub":"42"}'
POST only, and the query string is ignored. The API runs on this server, so the token travels; this page doesn't send it anywhere. Optional now (unix seconds) checks expiry at another moment, leeway sets the clock skew allowed (default 60s), and key_enc (utf8, base64, base64url, hex) fixes how a secret is read; left out, each reading is tried.
From an AI agent (MCP): https://mcp.corpberry.com/mcp/cipher · setup