JWT Encoder
Encode and sign JSON Web Tokens in your browser. Supports HMAC, RSA, ECDSA, and RSA-PSS.
JWT payload is Base64URL encoded, not encrypted. Never store passwords, API secrets, credit card numbers, or other sensitive information inside a JWT payload.
HMAC · SHA-256
Signing a JWT means taking a header and a payload, Base64url-encoding both, and producing a cryptographic signature over the joined string. The result is three segments separated by dots. Encoding is not encryption: anyone can read the payload. What signing gives you is integrity - a server that holds the matching key can prove the token was not altered after it left your hands. This encoder runs entirely in the browser via the Web Crypto API and supports the common HMAC (HS), RSA (RS), ECDSA (ES), and RSA-PSS (PS) algorithms from RFC 7518. Changes to the header, payload, algorithm, or key regenerate the token live.
How to use this tool
- Edit the headerChoose the algorithm and keep typ as JWT. The alg field stays in sync with the signing dropdown.
- Write the payloadAdd claims as JSON. Use the claim helpers for exp, iat, nbf, iss, sub, aud, and jti, including quick date presets for time claims.
- Provide the keyHMAC needs a secret. RSA, ECDSA, and RSA-PSS need a PEM private key - generate one in the tool or paste your own PKCS#8 key.
- Copy the signed tokenThe JWT updates as you type. Copy it, download it as a .txt file, or export the full configuration for later.
Why use it
- Live signing with no Generate button - the token updates as you edit.
- Full algorithm coverage: HS256/384/512, RS256/384/512, ES256/384/512, and PS256/384/512.
- Claim helpers and date presets for common registered claims.
- Everything stays in your browser - secrets and private keys are never uploaded.
- Import and export header, payload, or the entire encoder configuration.
Common uses
- Creating test tokens for local API authentication work.
- Prototyping OAuth or OpenID Connect claim shapes before wiring a real IdP.
- Comparing how different algorithms affect token length and key requirements.
- Teaching JWT structure with a visual, colour-coded token output.
- Generating short-lived tokens with precise exp / nbf timestamps.
Tips for better results
- Never put passwords, API keys, or card numbers in the payload - it is only encoded, not encrypted.
- For HMAC, prefer a long random secret (64+ characters). Use Regenerate with a chosen length.
- For RSA and ECDSA, use PKCS#8 PEM (BEGIN PRIVATE KEY). PKCS#1 RSA keys are converted automatically.
- Keep exp and iat as Unix seconds, not milliseconds.
- Use Ctrl+Enter to force regenerate and Ctrl+Shift+F to pretty-format both JSON panels.
Mistakes to avoid
- Treating a signed JWT as confidential. The signature does not hide the payload.
- Using the "none" algorithm or an empty secret in production systems.
- Mismatching the algorithm family and key type (HMAC secret with RS256, or an EC key with RS256).
- Pasting encrypted private keys - decrypt them first; encrypted PEMs are not supported here.
- Forgetting that exp is absolute Unix time, so a copied example timestamp may already be expired.
Frequently asked questions
Edit the header and payload JSON, pick an algorithm, enter a secret or private key, and copy the live-generated token. No Generate button is required.
HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, and PS512 - all signed in the browser with the Web Crypto API.
No. It is Base64url-encoded and readable by anyone who has the token. Signing protects integrity, not secrecy.
No. Encoding and signing run locally. Nothing is sent to a server for this tool.
A PKCS#8 PEM private key (BEGIN PRIVATE KEY). Traditional PKCS#1 RSA PRIVATE KEY blocks are accepted and wrapped automatically. Encrypted PEMs are not supported.
Click the exp claim helper, then choose Now, +1 hour, +1 day, +7 days, +30 days, or a custom date. The value is written as a Unix timestamp.
Yes. Use Import on either panel for a JSON file, or Import Config for a full encoder configuration including algorithm and keys.
The decoder inspects an existing token. The encoder builds and signs a new one. Use both together when debugging auth flows.
People also search for
- jwt encoder online
- sign jwt hs256
- create jwt token free
- jwt rs256 generator
- jwt es256 signer
- json web token encoder
- jwt.io alternative