JWT Encoder

Build and sign a JSON Web Token with your own secret key for testing an API.

Header

Payload

Secret (HMAC key)

Only HS256 (HMAC-SHA256) is supported — RS256 and other asymmetric algorithms need a private key, not a shared secret. Signing runs entirely in your browser via the Web Crypto API; the secret is never sent anywhere.

How to use JWT Encoder

Signing happens with the Web Crypto API in your browser — your secret key is never sent anywhere.

Edit the header and payload JSON — both need to stay valid JSON.
Enter your secret key.
The HS256-signed token updates automatically as you type.
Copy the token to test against your API.

→ check what you just signed

Reference: RFC 7519, the JSON Web Token spec

Frequently asked questions

Which signing algorithms does this support?

Only HS256 (HMAC-SHA256) — it uses a shared secret, which is what the Web Crypto API in a browser can do without a private key. RS256 and other asymmetric algorithms need a real private key and aren't supported.

Is my secret sent to a server?

No — signing happens entirely in your browser via the Web Crypto API; the secret and token never leave your device.

Can I use this to generate tokens for production use?

It's built for testing and development — decoding a working example, trying out a payload shape, debugging an API. Treat any secret you type here as disposable, not a real production signing key.

Community

Related tools

JSON Formatter

Format, validate, and beautify JSON with syntax highlighting.

Base64 Encoder / Decoder

Encode and decode Base64 strings instantly.

URL Encoder / Decoder

Encode or decode URL/percent-encoded strings.

HTML Encoder / Decoder

Convert special characters to HTML entities and back.