π JWT Encoder
Create and sign HS256 JSON Web Tokens locally.
π Your data never leaves your browser
Signed Token
Create signed JSON Web Tokens directly in your browser. Edit the header and payload JSON, enter a secret, and get a ready-to-use HS256 token β signed locally with the WebCrypto HMAC-SHA256 implementation, so your data never leaves your machine. Ideal for testing authenticated APIs, reproducing token-related bugs, or learning how JWTs are structured.
How to Use
- Edit the header: Adjust the JSON header β the default
{"alg": "HS256", "typ": "JWT"}works for most cases. - Edit the payload: Add or change claims such as
sub,name,iat, orexp. - Enter a secret: Type the HMAC secret used to sign the token.
- Copy the token: The signed JWT appears instantly and updates as you type β copy it with one click.
Features
- HS256 (HMAC-SHA256) signing via the native WebCrypto API
- Prefilled sample header and payload you can edit freely
- Live re-signing on every change β no extra click needed
- One-click copy of the finished token
- 100% client-side: no network requests, no data stored
What Is a JWT?
A JSON Web Token is three base64url-encoded parts joined by dots: header.payload.signature. The header declares the algorithm, the payload carries the claims, and the signature proves the token was created by someone holding the secret. With HS256, the signature is an HMAC-SHA256 hash of the first two parts keyed by your secret β anyone with the same secret can verify it, and anyone without it cannot forge it. That symmetry is why HS256 secrets must be guarded carefully and why you should only use test secrets in online tools.
Use Cases
- API testing: Mint a token with custom claims to test authorization rules in your backend.
- Debugging: Recreate a token with modified claims to reproduce an auth bug.
- Learning: See exactly how changing a claim or the secret changes the signature.
- Development: Generate tokens for local services without standing up an auth server.
Security Notes
This tool is for development and testing. Never paste production signing secrets into any website β including this one. A token signed with a weak or leaked secret can be forged by anyone, so use long random secrets in real systems and keep HS256 tokens on trusted backends only. To inspect a token you already have, use the JWT Decoder.
Related Tools
Frequently Asked Questions
Which signing algorithm does this JWT encoder support?
It signs with HS256 (HMAC-SHA256), the most widely used symmetric JWT algorithm. The same secret string is used to sign and later verify the token. Asymmetric algorithms like RS256 require key pairs and are not supported here.
Is it safe to enter my secret here?
All signing happens locally in your browser via the WebCrypto API β nothing is sent to any server. Still, you should never paste a real production secret into any online tool. Use a throwaway test secret and rotate any secret that has ever been pasted somewhere.
What should the header and payload look like?
Both fields expect valid JSON. The header is typically {"alg": "HS256", "typ": "JWT"} and the payload carries your claims, such as sub, name, iat, or exp. The tool preloads a working sample you can edit.
Does this tool validate my claims or expiration?
No. It signs exactly what you type β it does not check whether exp is in the past or whether claim names follow the registered claim conventions. Use the JWT Decoder to inspect the resulting token.
Why does my token differ from another encoder's output?
The signature depends on the exact bytes of the encoded header and payload. Different whitespace, key ordering, or a different secret all produce a different β but equally valid β signature.