How to Create an HS256 JWT (Header, Payload and Secret)
An HS256 token is a header and payload joined by a signature. This guide explains each part and how the signature is made.
What is the JWT Encoder?
This tool takes a header JSON object, a payload JSON object and a secret, then signs them with HMAC-SHA-256 using the browser's WebCrypto API to produce a standard three-part JWT. The secret never leaves your browser, but anyone holding the token can read its payload, so never put sensitive data in it and never share a production secret in a demo token.
How to use it
- Enter the header JSON (alg HS256) and the payload JSON.
- Enter the secret used for signing.
- Click Create JWT and copy the resulting token.
Worked example
Signing the sample header, payload and secret produces the well-known example token ending in SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c.
Is a JWT encrypted?
No. A standard JWT is signed, not encrypted: anyone can decode and read the payload, while the signature only proves it has not been changed since signing.
Frequently asked questions
Can anyone read the payload of my token?
Yes. The payload is only encoded, not encrypted, so treat anything in a JWT as readable by anyone who holds it.
Why does this tool need WebCrypto?
Signing uses HMAC-SHA-256 from the browser's WebCrypto API, which keeps the secret local instead of sending it to a server.