JWT Encoder
Build and sign a JSON Web Token with HMAC (HS256, HS384 or HS512) using the Web Crypto API — signing happens entirely in your browser, and the secret never leaves this page.
How to use
- Edit the header and payload JSON — change the alg field if you pick a different algorithm below.
- Enter the signing secret and choose HS256, HS384 or HS512.
- Click Sign token and copy the resulting JWT.
Note: HMAC secrets must stay secret — anyone holding the secret can forge tokens. This tool is for development and testing; production tokens should be signed on a server.
Tips
- Use a long, random secret — short or guessable secrets make HMAC-signed tokens easy to forge.
- Keep the payload small: tokens travel in HTTP headers, so large claims slow down every request.
- Include an exp claim (expiry timestamp) so tokens stop working after a set time.
Frequently Asked Questions (FAQ)
What does this tool do?
Build and sign a JSON Web Token with a custom header and payload using HMAC.
Which signing algorithms are supported?
HS256, HS384 and HS512, signed with the Web Crypto API.
Can I customize the token header?
Yes. You can edit both the header JSON and the payload JSON before pressing Sign token.
Is my secret sent anywhere?
No, signing happens entirely in your browser and the secret never leaves the page.