JWT Encoder

JWT Encoder Overview

A JWT (JSON Web Token) is an open standard (RFC 7519) consisting of Header, Payload, and Signature, each Base64URL-encoded and joined with dots.

This tool creates JWTs: pick an HMAC algorithm (HS256/HS384/HS512), edit payload claims (sub, exp, iat, etc.), enter a secret, and generate a token. Encoding runs locally—your secret and payload are never uploaded.

Pair it with the JWT Decoder: generate here, then paste there to inspect structure and verify the signature.

Supported Algorithms

• HS256 / HS384 / HS512: symmetric HMAC with a shared secret

Asymmetric algorithms (RS256, ES256) require a private key on the server; this encoder does not sign them. Use the decoder to read RS/ES tokens.

Typical Uses

• Build test tokens when debugging OAuth or login APIs
• Check how your backend handles exp, iss, and other claims
• Learn JWT structure and HMAC signing

Steps to Generate a JWT

1. Choose algorithm: HS256, HS384, or HS512 on the algorithm card
2. Edit payload: JSON claims or form fields for sub, name, exp; use the date picker for expiration
3. Enter secret: The HMAC key must match what verifiers expect
4. Generate: Click encode; the full JWT appears in the output area
5. Copy and verify: Paste into the JWT Decoder to view Header/Payload and verify with the same secret

Common Claims

See the IANA JWT Claims Registry for registered names.

Notes

• Payload is only Base64URL-encoded, not encrypted—do not put passwords inside
• Production tokens should be issued on the server; this tool is for development and testing

FAQ

Q: How is the encoder different from the decoder?

The decoder parses an existing token and can verify signatures. The encoder builds a new token from your payload and secret. Use both for a generate-then-inspect workflow.

Q: Why is RS256 / ES256 encoding not supported?

Asymmetric signing needs a private key and should not run in a browser utility. This encoder focuses on HMAC (HS*) for local debugging. Decode RS/ES tokens with the JWT Decoder.

Q: Is my secret sent to a server?

No. Encoding is local; secret and payload never leave your device.

Q: How do I set expiration?

Set exp in the payload (Unix timestamp in seconds) or use the expiration date picker. The decoder shows whether the token is expired.

Q: Can I use generated tokens in production?

This tool is for development and testing. Issue production tokens on the server with audited libraries, proper key management, and claim validation.

Q: How does this relate to OAuth access tokens?

Many OAuth 2.0 deployments use JWT-form access tokens with the same structure. This tool helps you understand token contents; it does not replace a full OAuth flow.