Skip to content
Conor Griffin.

macOS app

Tessera

A native Mac app for reading, verifying and building JSON Web Tokens. Paste a JWT or JWE and it answers the question you actually have: is this token valid, and if not, why?

Free to download, with an optional one-time Tessera Pro upgrade. No subscription, no account.

Download free for Mac Buy Pro

ProOne-time purchase, no subscription

  • Saved keys behind Touch ID
  • One-click keys from the issuer
  • JWE encryption and templates
  • Menu bar peek at copied tokens
See everything in Pro

Version 1.0.1, updated 8 Nov 2026. Requires macOS 15 or later. Coming soon to the Mac App Store too. Compare the two.

Features

Built to answer, not just decode.

Answers first

  • A live countdown to expiry, with a bar showing how much of the token's lifetime is left.
  • A clear verdict: Verified, Invalid signature, Unsigned or Key needed.
  • Plain-English security checks: alg none, expired or not-yet-valid tokens, missing audience, weak or well-known HMAC secrets.
  • Warnings for remote key URLs and embedded keys in the header.

Claims, not curly braces

  • Claims in a native grouped list with readable names, plus local and relative times.
  • Scopes and audiences shown as chips.
  • Syntax-highlighted JSON one keystroke away.
  • Copy any value, or the whole token.

Verify with any key

  • HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512 and EdDSA.
  • Paste a shared secret, PEM, X.509 certificate, JWK or JWKS (matched by kid).
  • Guards against algorithm confusion attacks.

JWE, too

  • See the protected header of any encrypted token and which key it needs.
  • Decrypt with RSA-OAEP, ECDH-ES (P-256, P-384, P-521, X25519), AES key wrap, PBES2 or a direct key.
  • Nested tokens decoded inline and verified in place.

Build and sign

  • Edit the header and claims as a form or as JSON.
  • Quick adds for exp, iat and jti.
  • Sign with any supported algorithm using a pasted secret or private key.

Made for the Mac

  • Built with SwiftUI and AppKit, in light and dark appearance.
  • VoiceOver labels and full keyboard control.
  • Open .jwt and .jwe files, or drag them onto the window.

A closer look

See it at work.

Security checks in plain English

A remote key URL and an embedded key in the header, flagged before you trust the token.

Claims, not curly braces

Readable names, local times, and scopes and audiences as chips.

JWE, inspected and decrypted

The protected header, the key it needs, and the nested signed token inside.

Build and sign

Edit claims as JSON with quick adds, then sign with any supported algorithm.

Keys in your KeychainPro

Name and tag the keys you use, optionally behind Touch ID.

Peek from the menu barPro

Copy a token anywhere and see who it's for and when it expires, without switching apps.

Tessera Pro

More, if you want it.

A one-time purchase. No subscription.

Free

  • Decode, inspect and verify JWT and JWE
  • Security checks and live expiry
  • Decrypt JWE with any supported key
  • Build and sign tokens

Pro Everything in Free, plus

  • Saved keys in your Keychain, optionally protected by Touch ID
  • Fetch keys from an issuer with OpenID Connect discovery and JWKS in one click
  • Encrypt tokens as JWE, sign with saved keys, and start from OAuth and OIDC templates
  • A menu bar popover and a global keyboard shortcut
  • Clipboard watch that notices tokens as you copy them, on device
  • Full history of up to 500 tokens, encrypted on your Mac, with Prod, Staging and Dev tags

Get Tessera

Two ways to get it.

Mac App Store

Install it from the App Store. Tessera Pro is an in-app purchase.

Coming soon to the Mac App Store

Download directly

The same app as a download from this site, with updates built in. Tessera Pro is a one-time license key, emailed to you straight away.

Download Buy Pro

The two versions are separate purchases: Pro bought in one doesn't unlock the other. Already bought directly? Find my license. See the terms of sale.

Questions

Before you download.

Is it really free?
Yes. Decoding, verifying, decrypting, the security checks and building and signing tokens are all free, with no time limit. Tessera Pro adds saved keys, issuer key fetching, JWE encryption, the menu bar popover and history.
Why not just use jwt.io?
jwt.io is great for a quick look. Tessera is for when you'd rather not paste a production token into a website, need to decrypt a JWE, or want your keys and history kept on your Mac. It's also one ⌘V away, with plain-English security checks and a live expiry countdown.
Is Tessera Pro a subscription?
No. It's a one-time purchase, shown in your local currency at checkout.
Is the download safe to open?
Yes. It's signed with my Apple Developer ID and notarized by Apple, so it opens like any other Mac app. Updates arrive inside the app.
What's the difference between this and the App Store version?
It's the same app. The direct version updates itself and Tessera Pro is a license key sent by email. The App Store version uses Apple's in-app purchase. The two purchases are separate.
Does Tessera send my tokens anywhere?
No. Tokens, keys and history never leave your Mac. Tessera only goes online to fetch an issuer's public keys when you ask, which goes straight to the issuer and sends nothing from your token. The direct-download version also checks this site for updates and for refunded licenses, without sending anything about you or your tokens.
What do I need?
A Mac running macOS 15 or later.

More answers on the support page.