🎟️ JWT Encoder / Signer
Create a signed JWT from your payload and secret — HS256/384/512, computed locally so the secret never leaves your browser.
Only HS* algorithms (HMAC with a shared secret) are supported. RS/ES (public-key) signing needs a private key and isn't offered here.
This creates (signs) a token. To read one, use the JWT decoder to inspect a token. Your secret and payload never leave your browser — signing happens entirely on your device.
How the jwt encoder / signer works
A JWT has three parts joined by dots: a header ({"alg","typ"}), your payload of claims, and a signature. The tool base64url-encodes the header and payload, signs "header.payload" with your secret using HMAC (HS256, HS384 or HS512) via Web Crypto, and appends the base64url signature. The result is a token you can drop into an Authorization header or a test — and read back with the JWT decoder.
This signs with HMAC (HS*) algorithms, which use one shared secret to both sign and verify — ideal for testing, internal services and learning how JWTs are built. Public-key algorithms (RS256, ES256) sign with a private key and verify with a public one; those need key material this tool intentionally doesn't handle. Remember a JWT payload is only base64-encoded, not encrypted — never put secrets in it. Everything runs on your device.
Frequently asked questions
How do I create a JWT?
Enter your payload as JSON, pick an algorithm (HS256 is standard), and provide the signing secret — the tool outputs the signed three-part token. Header {alg, typ:"JWT"} is generated for you.
What's the difference between HS256 and RS256?
HS256 uses one shared secret for both signing and verifying (HMAC). RS256 uses a private key to sign and a public key to verify. This tool does HS* (shared-secret) signing; RS/ES need key pairs.
Is the JWT payload encrypted?
No — the header and payload are only base64url-encoded and can be read by anyone with the token. The signature guarantees they weren't altered, but it doesn't hide them, so never put secrets in a JWT.
How do I read a token back?
Use the JWT decoder to inspect any token's header and payload. This encoder is the reverse — it builds and signs a token from a payload you provide.
Is my secret sent anywhere?
No — the token is signed with Web Crypto in your browser. The payload and secret never leave your device, and it works offline.