JWT Encoder
Runs in your browser — your data is never uploaded.
Build a signed JSON Web Token from a payload and a shared secret — the quickest way to get a valid test token for an API you are developing against, without wiring up an auth server first. The header is generated for you, the payload is whatever claims you paste, and the signature is computed with HMAC through your browser’s native WebCrypto. Nothing is transmitted, which is the only reason typing a signing secret into a web page is defensible at all.
0 characters · runs entirely in your browser
How to use JWT Encoder
- 1
Paste your payload as JSON — for example {"sub":"1234567890","name":"Ada"}.
- 2
Enter the shared secret to sign with, and pick HS256, HS384 or HS512.
- 3
Click “Sign” and copy the complete token.
Share
Embed this tool on your site
Paste this where you want the tool to appear. It runs entirely in your visitor's browser — no uploads, no account, no tracking.
Please keep the attribution line — it's what keeps these tools free.
Need a different size, a dark theme, or a different tool? Build an embed lets you preview it first.
Frequently asked questions
Why only HMAC — where are RS256 and ES256?+
Those sign with a private key, and pasting a production RSA or ECDSA private key into a web page is a habit worth not building, however local the page is. A shared HMAC secret used to mint a development token is a genuinely different risk, and it is what people come here for.
Is my secret uploaded?+
No. The HMAC is computed by crypto.subtle in your browser and nothing is sent anywhere — you can confirm that by loading the page and disconnecting from the network before signing. Even so, treat any secret you paste into any browser tab as one you should rotate before production.
Should I put an expiry in the payload?+
Yes, for anything realistic. Add an "exp" claim as a Unix timestamp in seconds — our timestamp converter will give you one. A token with no expiry is valid until the signing key changes, which is rarely what you want even in testing.
Are the claims validated?+
No. Any JSON object is accepted and signed as-is, deliberately — testing how your service reacts to a missing or malformed claim is a normal thing to want to do.
How do I check what I just made?+
Paste it into our JWT decoder to see the header and payload it carries. Note that the decoder does not verify signatures — that needs the secret, and it never has it.