JWT Encoder
JWT Encoder builds a complete, signed JSON Web Token from a header, a payload and a secret. It Base64URL-encodes your JSON and signs it with HS256 using the Web Crypto API, producing a token you can copy and use immediately.
Everything — including the HMAC signing — happens locally in your browser, so your secret never leaves the page. This encoder supports the HS256 algorithm.
Signed JWT (HS256)
—
Only the HS256 algorithm is supported. Signing happens entirely in your browser with the Web Crypto API — your secret never leaves this page.
How to use JWT Encoder
- 1
Set the header and payload
Edit the header (defaulting to HS256) and the payload JSON with your own claims such as sub, name and iat.
- 2
Enter a secret
Type the HMAC secret that will sign the token. The same secret is needed later to verify it.
- 3
Copy the token
The signed JWT updates live as you type. Copy it once your inputs are valid — any JSON errors are flagged inline.
How HS256 signing works
HS256 stands for HMAC using SHA-256. The encoder takes the Base64URL-encoded header and payload, joins them with a dot to form the signing input, then computes an HMAC-SHA-256 of that string using your secret as the key. The resulting bytes are Base64URL-encoded and appended as the third segment, giving the familiar header.payload.signature shape.
Because HMAC is symmetric, the same secret both creates and verifies the signature. Anyone who knows the secret can mint valid tokens, so it must be kept private and should be long and random — a short or guessable secret undermines the whole scheme.
Choosing claims for your payload
The payload holds claims about the subject and the token itself. Registered claims have standard meanings: sub (subject), iss (issuer), aud (audience), exp (expiration time), nbf (not before), iat (issued at) and jti (a unique ID). The time-based claims are Unix timestamps in seconds, not milliseconds — a common source of confusion.
You can add any custom claims your application needs, such as a user role or tenant ID. Keep the payload small, since it travels with every request, and never include passwords or other secrets — the payload is only encoded, so it is readable by anyone holding the token.
Frequently asked questions
- Which algorithms are supported?
- Only HS256 (HMAC-SHA-256). If you change the header's alg to anything else, the encoder will ask you to set it back to HS256.
- Is my secret sent anywhere?
- No. Signing uses the browser's Web Crypto API, so the secret and tokens never leave your device.
- Why is my token rejected when I verify it elsewhere?
- Verification must use the exact same secret you signed with. Check for stray whitespace, and make sure the verifying system also expects HS256.
- What format should timestamps use?
- Claims like iat, exp and nbf are Unix timestamps in seconds. Divide a millisecond value by 1000 before putting it in the payload.
Last updated: