JWT Encoder

The JWT Encoder builds a signed JSON Web Token (JWT) from three pieces: a header, a payload, and a secret key. It base64url-encodes the header and payload, joins them with a dot, computes an HMAC signature over that string, and appends the encoded signature — producing the familiar header.payload.signature token used for stateless authentication and API authorization.

Everything runs in your browser. Nothing is uploaded, so it is safe for quickly assembling test tokens while you develop.

How to use it

1. Header (JSON) — a JSON object such as {"alg":"HS256","typ":"JWT"}. You can add extra fields like kid (key ID). The alg field is set automatically to match the algorithm you pick below, so the token never misrepresents how it was signed.
2. Payload (JSON) — the claims you want to encode, for example {"sub":"1234567890","name":"John Doe","iat":1516239022}. Standard claims include iss (issuer), sub (subject), aud (audience), exp (expiry) and iat (issued-at).
3. Algorithm — choose HS256, HS384 or HS512 (HMAC with SHA-256, SHA-384 or SHA-512).
4. Secret — the signing key, treated as UTF-8 text.

The token, plus each encoded part (header, payload, signature), appears instantly and updates as you type. Copy the token, or download it as a .jwt file.

Try an example

Load the built-in example to see the canonical eyJhbGci… token that matches the well-known JWT reference vector, then edit the payload to explore how the signature changes.

Frequently asked questions

What is a JWT?

A JSON Web Token (RFC 7519) is a compact, URL-safe way to represent claims between two parties. It has three base64url-encoded parts separated by dots: a header describing the signing algorithm, a payload of claims, and a signature that lets the recipient verify the token was not tampered with.

Which algorithms are supported?

HS256, HS384 and HS512 — the HMAC family, where the same secret both signs and verifies. Asymmetric algorithms such as RS256 and ES256 (RSA/ECDSA with public–private key pairs) are not supported here: they require private-key signing that cannot run synchronously in the browser. Use a dedicated server-side signer for those.

Does the tool add an iat or exp for me?

No. Signing is fully deterministic — it encodes exactly the payload you provide. If you want an issued-at or expiry claim, type the Unix timestamp directly into the payload JSON. This keeps the same input always producing the same token.

Why does the header show alg even if I omit it?

The signature is only meaningful if the header's alg claim matches the algorithm actually used. The tool always writes alg (and defaults typ to JWT) so the token is well-formed.

Is a JWT encrypted?

No. The header and payload are only base64url-encoded, not encrypted — anyone can read them. The signature proves integrity and authenticity, not confidentiality. Never put secrets in a JWT payload.

Privacy

This tool runs entirely in your browser. Your payload, your header, and especially your secret key never leave your device — no data is sent to any server. Even so, treat this as a scratchpad: paste test secrets, not real production signing keys.