JWT Encoder
Cmd/Ctrl+Enter saves the payload to history (never the secret).
Signs entirely in your browser — the secret is never sent anywhere, saved to history, or included in the shareable link.
Advertisement
Build a header and payload, provide a secret, and get a signed HS256 JWT. Signing uses the browser's native Web Crypto HMAC implementation — the secret never leaves the page, matching the rest of this suite's no-server-round-trip design. HS256 only: it needs a single shared secret, not a private/public key pair.
Frequently asked questions
- Does my secret get sent anywhere?
- No. Signing uses the browser's native Web Crypto HMAC implementation entirely client-side — the secret is used locally to compute the signature and never leaves the page, there's no server round-trip at all.
- Does it support RS256 or other asymmetric algorithms?
- No — HS256 (HMAC-SHA256) only. HS256 uses a single shared secret for both signing and verifying, which is what this tool is built around; RS256/ES256 need a private/public key pair instead of a secret.
- Can I use this to generate a real production token?
- Technically yes — the signature is a correct HS256 signature — but pasting a production signing secret into any browser tool is a bad practice regardless of where the computation happens. Use it for testing and understanding JWT structure, not for issuing live tokens.
- Is my payload uploaded anywhere?
- No. Encoding and signing happen locally in your browser tab — nothing is sent to a server.
Read the full guide for this tool →
Related tools & guides
Part of JWT Tools & Guide
Advertisement