JWT Encoder
Free online JWT encoder. Create and sign JSON Web Tokens in your browser. Supports HS256/HS384/HS512. All processing is local — your secret never leaves your device.
Authorization: Bearer <token> header.
How to Use JWT Encoder
Enter Header and Payload
Fill in the JWT header (typically {"alg":"HS256","typ":"JWT"}) and payload (your claims like sub, name, iat, exp). Both are JSON objects that define your token.
Enter Your Secret Key
Enter the secret key used to sign the token. For HS256 (HMAC-SHA256), this is a shared secret string. For security, use a long, random key in production — never hardcode secrets in source code.
Copy the JWT
Click "Generate JWT" to create the signed token. The output is a complete JWT in the format header.payload.signature, ready for use in Authentication headers or API requests.
Example
With these inputs:
{"alg":"HS256","typ":"JWT"}{"sub":"123","name":"Alice"}my-secret-keyYou'll get a valid JWT with three dot-separated parts. You can verify it with the JWT Decoder tool.
Frequently Asked Questions
Is it safe to generate JWTs in a browser?
This tool generates JWTs entirely in your browser using the Web Crypto API. Your secret key never leaves your computer. However, for production use, JWTs should be generated on your server where secrets can be stored securely (environment variables, secrets manager). This tool is intended for testing, learning, and debugging.
What signing algorithms are supported?
This tool supports HS256 (HMAC with SHA-256), HS384, and HS512. These are symmetric algorithms — the same secret key is used for both signing and verification. For asymmetric signing (RS256, ES256), use a server-side library since browser Web Crypto API support varies for these algorithms.
What claims should I include in the payload?
Common claims include: sub (subject/user ID), name (display name), iat (issued at — current timestamp), exp (expiration time), and iss (issuer). For security, always set an exp claim so tokens expire. Never put sensitive data (passwords, credit cards) in JWTs — the payload is only Base64-encoded, not encrypted.
Creating JWTs for Testing
This tool is invaluable for testing APIs that require JWT authentication. Instead of setting up a full auth server just to get a test token, you can quickly generate a valid JWT with custom claims. Generate a token with a specific user ID, expiration time, or custom claim, and use it to test your API's authorization logic.
Important Security Note
Never use browser-generated JWTs in production. In production, your server should generate JWTs after authenticating the user. The secret key should be stored in an environment variable or secrets manager — never in client-side code, never in your git repository. This tool is for testing and learning only.