GUIDE
Local signatures and password checks
Choose a tool based on whether you need a signature or a password check.
On this page
Sign exact text
A keyed message authentication code combines exact message bytes with a secret key. Whitespace and Unicode spelling affect the result. Never use example keys for real applications.
With a test key, sign Hello, then sign Hello! with the same key. The codes differ because the message changed.Keep signed data readable
A signed JSON Web Token contains readable properties plus a signature. Decoding is separate from checking a signature. Do not put confidential information in a token payload.
Sign {"role":"reader"} with an example key. Paste the result into JWT Decoder. You can read the role without the key; verifying who signed it requires the key.Check a password
Bcrypt generates a fresh random salt for each password hash. Compare a password with the stored hash to verify it. The 72-byte limit applies to encoded text, including multi-byte characters.
Generate twice with the same test password: the hashes differ because each has a new salt. Switch to Check and compare the same password with either stored hash. Both match.