JWT Encoder
The JWT Encoder builds a JSON Web Token from a payload and signs it with HS256, HS384 or HS512. Signing happens in your browser — your secret never leaves the page.
A JSON Web Token (JWT) has three parts — a header, a payload and a signature — each Base64URL-encoded and joined with dots. This encoder builds the header and payload from your JSON and signs them with an HMAC secret using HS256, HS384 or HS512, all in your browser using the Web Crypto API, so your secret never leaves the page. Edit the payload, set a secret and the token updates live. To read an existing token, use the JWT Decoder. Do not paste a real production secret into any web page you do not control.
Frequently Asked Questions
How is the JWT signed?
The header and payload are Base64URL-encoded and joined with a dot to form the signing input. The signature is an HMAC of that input using your secret and the chosen SHA algorithm — HS256, HS384 or HS512 — computed with the browser’s built-in Web Crypto API. The final token is header.payload.signature. Everything happens on your device, so the secret is never sent anywhere.
Does it support RS256 and other asymmetric algorithms?
RS256 and other asymmetric algorithms are not supported here — this tool signs with the HMAC family (HS256/384/512), which uses a single shared secret, the most common choice for tokens issued and verified by the same service. RS256 and ES256 use a private key to sign and a public key to verify, so a different party can check the signature without ever holding the signing key. Generating and handling private keys safely belongs in your backend rather than a web page, so asymmetric algorithms are intentionally not offered here. If you need RS256, use a server-side JWT library where the private key can be stored securely.
Is my secret safe?
The signing runs entirely in your browser and your secret is never uploaded, logged or stored. That said, as a general rule you should never paste a real production signing secret into any website you do not fully control. Use this tool with test secrets, or for learning how JWTs are built; issue and sign production tokens on your server.
How do I add an expiration to my JWT?
Add an exp claim to the payload JSON yourself — a Unix timestamp in seconds for when the token should expire, such as "exp": 1735689600. This tool does not add expiration automatically; it encodes and signs exactly the payload you provide, so standard claims like exp, iat or sub need to be in the JSON before you sign it. Whether exp is actually enforced depends on the library that later verifies the token.