About the JWT Encoder
This tool builds a signed JSON Web Token from a header, a payload, and a secret, using HMAC-based signing (HS256, HS384, or HS512) — the same algorithm family most APIs use for symmetric-key JWT authentication.
It's meant for testing and development: generating sample tokens to feed into an API, a Postman collection, or a local auth flow without needing a running auth server.
How it works
- Edit the Header and Payload JSON to match the claims you want (e.g. `sub`, `exp`, custom claims).
- Enter a secret key matching the algorithm declared in the header's `alg` field.
- Click Generate to produce a complete, signed JWT you can copy and use immediately.
Common use cases
- Local API testing: Generating a short-lived test token with a custom `role` claim to exercise an authorization code path without a real login flow.
- Reproducing a bug: Rebuilding a JWT with slightly different claim values to see how your backend handles edge cases, like a missing `exp` or an unexpected `aud`.
- Learning JWT structure: Editing the header and payload and watching how each part changes the resulting encoded token.
Frequently asked questions
Is a token generated here suitable for production use?
No — this tool is meant for local development and testing. In production, tokens should be issued by a proper auth server using securely stored secrets and short expiry times, never hand-built and pasted from a browser tool.
Which algorithms are supported?
HS256, HS384, and HS512 — all symmetric HMAC-based algorithms where the same secret is used to sign and verify. Asymmetric algorithms like RS256 (which use a public/private key pair) aren't supported here.
Where does my secret go?
Nowhere but your browser's memory for the duration of this page — signing happens entirely client-side and the secret is never transmitted anywhere.
Why did I get an 'Failed to encode' error?
Usually this means the Header or Payload field isn't valid JSON — check for missing commas, unquoted keys, or trailing commas before generating again.
This tool runs entirely in your browser — nothing you enter is sent to a server. Read more in the Privacy Policy, or browse the full list of tools.