JWT Encoder
Build an HS256-signed JSON Web Token from a header, payload and secret.
Quick answer: enter your details below and click Create JWT — your result appears instantly, right here in your browser. Nothing you enter is uploaded or stored.
J
Developer
Enter your details below.
How to use
- Enter the header JSON (alg HS256) and the payload JSON.
- Enter the secret used for signing.
- Click Create JWT and copy the resulting token.
About this tool
This tool takes a header JSON object, a payload JSON object and a secret, then signs them with HMAC-SHA-256 using the browser's WebCrypto API to produce a standard three-part JWT. The secret never leaves your browser, but anyone holding the token can read its payload, so never put sensitive data in it and never share a production secret in a demo token.
Frequently asked questions
Can anyone read the payload of my token?
Yes. The payload is only encoded, not encrypted, so treat anything in a JWT as readable by anyone who holds it.
Why does this tool need WebCrypto?
Signing uses HMAC-SHA-256 from the browser's WebCrypto API, which keeps the secret local instead of sending it to a server.