JWT Encoder & Token Generator

It builds and signs a JSON Web Token from a JSON payload you supply. Pick an HMAC algorithm (HS256, HS384, or HS512), enter a secret, and the tool produces a complete header.payload.signature token you can paste into an Authorization header or test against your backend.

This tool supports HS256, HS384, and HS512 — all HMAC-based symmetric algorithms that use a shared secret. Asymmetric algorithms like RS256, RS384, ES256, and EdDSA require a private key file and are intentionally not supported here to avoid handling private keys in the browser.

No. Signing is done locally with the browser's built-in Web Crypto API (crypto.subtle). Your payload, secret, and the resulting token never leave your device — there are no network requests, no logging, and no storage.

A JSON object containing your claims. Common standard claims are sub (subject / user id), iss (issuer), aud (audience), exp (expiration as Unix seconds), nbf (not before), and iat (issued at). You can also include any custom claims your application needs, such as role, scope, or tenant_id.

Add an exp claim with a Unix timestamp in seconds. For example, to expire in one hour from now use Math.floor(Date.now()/1000) + 3600. The sample payload in this tool includes a working iat and exp pair you can copy and adjust.

RFC 7518 recommends a key of at least the same length as the hash output: 256 bits (32 bytes) for HS256, 384 bits for HS384, and 512 bits for HS512. Use a cryptographically random secret — never a dictionary word or a short string — and store it as an environment variable on your server.

You can, but the security of the token depends entirely on the secret you used to sign it. Anyone who has the secret can forge tokens with arbitrary claims, so never paste a real production secret into any third-party tool — including this one. For production use, generate and sign tokens on your server with a secret stored in a secrets manager.

That is the standard minimal header for a signed JWT. The alg field tells verifiers which algorithm to use, and typ identifies the token as a JWT (this is informational only). This tool fixes the header so the output is interoperable with every JWT library — you only need to control the claims.

Use the JWT Decoder on this site to inspect the header and payload, then use any JWT library on your server (jsonwebtoken for Node.js, PyJWT for Python, jose for many languages) with the same secret and algorithm to verify the signature. If verification passes, the token is intact and was signed with the secret you supplied.