Decode shows the header and claims without checking the signature. Verify checks the signature with your secret or public key and the exp/nbf/iat claims; the selected algorithm is enforced against the header. Sign builds a token from JSON claims with a secret or private key. Secret and keypair generate signing material with WebCrypto: HMAC secrets sized to the algorithm (HS256 ≥ 32 bytes, HS384 ≥ 48, HS512 ≥ 64) and RS/PS/ES/EdDSA key pairs as PEM plus JWK with RFC 7638 thumbprints. Keys and private material stay in memory; nothing is saved or sent.
decode and verify read the JWT above; sign reads Claims; secret and keypair generate.
HS* use a shared secret; RS/PS/ES/EdDSA use a key pair.
Verify: secret or public key. Sign: secret or PKCS#8 private key. Never stored.
JSON object. iat and exp are added unless present.
How the HS* secret above is encoded; PEM/JWK keys are detected automatically.
0 leaves exp out.
32 bytes = 256 bits, the same as openssl rand -hex 32.
RS/PS only; 2048 is the minimum for production tokens.