JWT Encoder
Build a JSON Web Token from a payload and sign it with HS256, HS384 or HS512. Signing happens in your browser — your secret never leaves the page.
A JSON Web Token (JWT) has three parts — a header, a payload and a signature — each Base64URL-encoded and joined with dots. This encoder builds the header and payload from your JSON and signs them with an HMAC secret using HS256, HS384 or HS512, all in your browser using the Web Crypto API, so your secret never leaves the page. Edit the payload, set a secret and the token updates live. To read an existing token, use the JWT Decoder. Do not paste a real production secret into any web page you do not control.
Frequently Asked Questions
How is the JWT signed?
The header and payload are Base64URL-encoded and joined with a dot to form the signing input. The signature is an HMAC of that input using your secret and the chosen SHA algorithm — HS256, HS384 or HS512 — computed with the browser’s built-in Web Crypto API. The final token is header.payload.signature. Everything happens on your device, so the secret is never sent anywhere.
Does it support RS256 and other asymmetric algorithms?
This tool signs with the HMAC family (HS256/384/512), which uses a single shared secret — the most common choice for tokens issued and verified by the same service. RS256 and ES256 use a private key to sign and a public key to verify; generating and handling private keys safely belongs in your backend rather than a web page, so they are intentionally not offered here.
Is my secret safe?
The signing runs entirely in your browser and your secret is never uploaded, logged or stored. That said, as a general rule you should never paste a real production signing secret into any website you do not fully control. Use this tool with test secrets, or for learning how JWTs are built; issue and sign production tokens on your server.