🎟️ JWT Encoder / Signer
Create a signed JWT from your payload and secret, HS256/384/512, computed locally so the secret never leaves your browser.
Only HS* algorithms (HMAC with a shared secret) are supported. RS/ES (public-key) signing needs a private key and isn't offered here.
This creates (signs) a token. To read one, use the JWT decoder to inspect a token. Your secret and payload never leave your browser, signing happens entirely on your device.
How the jwt encoder / signer works
A JWT has three parts joined by dots: a header ({"alg","typ"}), your payload of claims, and a signature. The tool base64url-encodes the header and payload, signs "header.payload" with your secret using HMAC (HS256, HS384 or HS512) via Web Crypto, and appends the base64url signature. The result is a token you can drop into an Authorization header or a test, and read back with the JWT decoder.
This signs with HMAC (HS*) algorithms, which use one shared secret to both sign and verify, ideal for testing, internal services and learning how JWTs are built. Public-key algorithms (RS256, ES256) sign with a private key and verify with a public one; those need key material this tool intentionally doesn't handle. Remember a JWT payload is only base64-encoded, not encrypted, never put secrets in it. Everything runs on your device.
Frequently asked questions
How do I create a JWT?
Enter your payload as JSON, pick an algorithm (HS256 is standard), and provide the signing secret, the tool outputs the signed three-part token. Header {alg, typ:"JWT"} is generated for you.
What's the difference between HS256 and RS256?
HS256 uses one shared secret for both signing and verifying (HMAC). RS256 uses a private key to sign and a public key to verify. This tool does HS* (shared-secret) signing; RS/ES need key pairs.
Is the JWT payload encrypted?
No, the header and payload are only base64url-encoded and can be read by anyone with the token. The signature guarantees they weren't altered, but it doesn't hide them, so never put secrets in a JWT.
How do I read a token back?
Use the JWT decoder to inspect any token's header and payload. This encoder is the reverse. It builds and signs a token from a payload you provide.
Is my secret sent anywhere?
No, the token is signed with Web Crypto in your browser. The payload and secret never leave your device, and it works offline.