JWT Encoder / Generator
🔒 In your browserBuild and sign a JWT with HS256/384/512.
Signs with HMAC (HS256/384/512) using the Web Crypto API. For RS/ES tokens you need a private key — generate those server-side.
🔒 Your token and secret never leave your browser — everything runs locally via the Web Crypto API.
🔒 Private by design: tokens, secrets, and keys are processed entirely in your browser with the Web Crypto API — nothing is sent to a server, stored, or logged. Even so, avoid pasting production secrets into any online tool.
About the JWT Encoder / Generator
Need a signed token for testing or an integration? This free JWT encoder builds a JSON Web Token from your header and payload and signs it with HMAC (HS256, HS384 or HS512) using your secret — all in your browser.
Your secret and payload never leave your device.
How to create a JWT
- Enter your claims (payload) as JSON.
- Choose the HMAC algorithm and provide your signing secret.
- Copy the generated, signed token.
The three parts of a JWT
A JWT has three Base64url-encoded parts separated by dots: the header (which algorithm signed it), the payload (your claims, such as the user id and an expiry), and the signature. This encoder builds the header and payload from your input and computes the HMAC signature with your secret, giving you a complete, verifiable token.
Frequently asked questions
How do I generate a JWT?
Provide the payload claims and a signing secret, choose HS256/384/512, and the tool builds and signs the token in your browser.
Which algorithms are supported?
HMAC-based signing with HS256, HS384 and HS512, which use a shared secret to sign and later verify the token.
Is my secret uploaded?
No. Signing happens locally with the Web Crypto API and your secret never leaves your browser.
Should I use this to sign production tokens?
It's built for testing, learning and quick integrations. For production, sign tokens on your server so the secret never reaches a browser, and prefer a short expiry and audience/issuer claims.
What claims should I include?
Common registered claims are exp (expiry), iat (issued-at), sub (subject/user id), iss (issuer) and aud (audience). Add your own custom claims as needed, but keep tokens small since they travel on every request.
Related searches
Learn more
Related Developer tools
🔗 Embed this tool on your website — free
Copy this and paste it into your page's HTML. The tool runs in the visitor's browser, just like here. Change height to fit, or add the optional auto-resize snippet below. Add ?theme=dark to the URL for dark mode.
<iframe src="https://toolhq.dev/embed/jwt-encoder/" title="JWT Encoder / Generator — ToolsHub" width="100%" height="520" style="border:1px solid #e5e7eb;border-radius:12px;max-width:680px" loading="lazy"></iframe>Optional: auto-resize the iframe height
Add this once on the same page so the iframe grows to fit the tool:
<script>
addEventListener("message", function (e) {
if (e.data && e.data.type === "toolshub:resize") {
document.querySelectorAll('iframe[src*="/embed/"]').forEach(function (f) {
if (f.contentWindow === e.source) f.style.height = e.data.height + "px";
});
}
});
</script>