MyDevTools
EN

JWT Encoder

Create and sign JWTs with HS256, HS384 or HS512 in your browser. Edit header and payload JSON; claim order and extra header fields like kid are kept.

Your inputs and files stay in your browser

Need to decode a token? Go to JWT Decoder

Header, payload and signing

Fix the header and payload JSON — the signed token appears here as you type.

On this page

Build a signed JSON Web Token for testing APIs and authentication flows: edit the header and payload JSON, choose HS256, HS384 or HS512, enter a secret and copy the token, which updates on every keystroke.

Detailed Functionality

The header and the payload must each be a JSON object; invalid JSON or a non-object such as an array is flagged under its field and no token is produced. The JSON is compacted (whitespace removed) and base64url-encoded without padding, keeping your claim order and extra header fields such as kid or cty. The alg value in the header is replaced with the algorithm selected in the list, or added first if it is missing.

The HMAC signature (SHA-256, SHA-384 or SHA-512) is computed by a Rust cryptography module compiled to WebAssembly; the secret is used as UTF-8 text. Only symmetric HMAC algorithms are available — RS256 or ES256 tokens, which need a private key, cannot be created here. An empty secret still produces a token signed with an empty key, which is only good for experiments.

The secret and the claims stay in the page and are not saved. The tool does not add iat or exp on its own: put NumericDate values (Unix time in seconds) into the payload yourself.

Practical Examples

jwt.io test vector: the default header {"alg":"HS256","typ":"JWT"} and payload {"sub":"1234567890","name":"John Doe","iat":1516239022} with the secret your-256-bit-secret give a token ending in SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c, exactly as on jwt.io.

Key ID and expiry: header {"alg":"HS256","typ":"JWT","kid":"key-2026"}, payload {"sub":"42","role":"admin","exp":1767225600} and algorithm HS384 — the encoded header becomes {"alg":"HS384","typ":"JWT","kid":"key-2026"} with the field order kept, and the signature is 64 characters long.

Not an object: a payload of [1,2] shows “Must be a JSON object” under the field and the token is cleared.

How to Use This Tool

  1. Edit the header

    Adjust the JSON in Header — add kid if your verifier needs it; alg is set from the algorithm list.

  2. Write the claims

    Put your claims (sub, role, exp …) into Payload as a JSON object.

  3. Choose the algorithm and secret

    Select HS256, HS384 or HS512 in Algorithm and type the shared secret into Secret Key.

  4. Copy the token

    The token in Encoded Token updates on every change; press Copy Token to copy it.

Tips and Best Practices

  • Use a random secret at least as long as the hash: 32 bytes for HS256, 48 for HS384, 64 for HS512.
  • exp, nbf and iat are in seconds, not milliseconds: 1767225600, not 1767225600000.
  • Every character of the secret counts, including a trailing space or line break.
  • The payload is only base64url-encoded, not encrypted — anyone with the token can read it.
  • Check the result in the JWT Decoder with the same secret.