Build and sign a demonstration JWT locally with HS256, HS384 or HS512. For testing only – never paste a production signing secret into any web page.
Show calculation steps
Processed privately in your browser — nothing you paste is uploaded, logged or stored.
How to use the JWT Encoder
- Enter the header JSON in the first panel and the claims JSON in the second.
- Choose the algorithm and enter a throwaway signing secret.
- Click "Sign JWT" – the token is built and signed locally using the browser WebCrypto API.
- Use the JWT Decoder or Structure Validator to inspect what you produced.
Frequently asked questions
Is it safe to enter a signing secret here?
Use a throwaway value only. The secret never leaves your browser – it is not transmitted, not logged and never sent to analytics – but a production signing secret should not be pasted into any web page, browser extension or third-party tool as a matter of policy. Sign real tokens on your server.
Why are only HMAC algorithms offered?
Because HS256, HS384 and HS512 use a shared secret, which is appropriate for a local testing tool. RSA and ECDSA signing needs a private key, and private keys should never be pasted into a web page – so offering them would encourage a genuinely dangerous habit.
What is this tool actually for?
Producing test fixtures. It is useful for exercising your own verification code, building examples for documentation, and demonstrating what changes in a token when a claim changes. It is not a production token issuer.
What happens if I choose alg none?
You get an unsigned token with an empty signature section, which is useful for demonstrating why verifiers must reject that algorithm. The tool warns you clearly, because such a token offers no protection whatsoever.
