JSON Web Tokens are the standard way modern APIs carry identity: a compact, three-part string — header, payload and signature, joined by dots — that a client presents with each request and a server verifies without looking anything up. Developers constantly need to build test tokens: to try an endpoint, to reproduce a bug, or to understand what a token actually contains. This encoder builds a signed JWT in your browser. Enter header and payload JSON, provide a secret, and it produces an HS256-signed token using the Web Crypto API, ready to paste into an API client. It complements the JWT decoder on this site, which reads tokens back apart. Two warnings matter: this tool signs with HS256 and test secrets only — production signing keys must never be pasted into a browser — and a JWT payload is readable by anyone holding the token, since it is only encoded, not encrypted.
Quick Answer: Enter header and payload JSON plus a secret, and get an HS256-signed JWT — three dot-separated parts, ready to test with any API.
Free Online Tool
JWT Encoder
How to Use the JWT Encoder
- Enter the header JSON, or leave the default HS256 header.
- Enter the payload JSON with the claims your API expects.
- Enter a secret key for signing — use a test secret, never a production key.
- Press Encode JWT and read the three-part token.
- Copy the token into your API client or test harness.
Key Features
- HS256 signing via the Web Crypto API
- Editable header and payload JSON with validation
- Standard three-part token output, ready for API clients
- Clear errors for invalid JSON before signing
- Free, instant and entirely in your browser
Best Practices and Tips
- Use test secrets here: a signing key pasted into any web page should be treated as exposed.
- Remember that payloads are readable, not secret — never put passwords or sensitive data in a JWT claim.
- Set exp (expiry) on test tokens so a leaked token stops working quickly.
- If an API rejects your token, check the algorithm first: this tool signs HS256, and some APIs expect RS256.
- Decode your new token with the JWT decoder on this site to confirm the claims landed as intended.
Common Mistakes to Avoid
- Pasting a production signing key into a browser tool.
- Putting sensitive data in the payload and assuming the token is encrypted — it is only encoded.
- Sending invalid JSON in the header or payload, which cannot be signed at all.
- Forgetting the expiry claim, which leaves test tokens valid indefinitely.
Frequently Asked Questions
What is a JWT?
A JSON Web Token is a compact, URL-safe way to carry claims between parties. It has three Base64URL parts — header, payload and signature — joined by dots. Servers verify the signature to trust the claims without a database lookup.
How does this encoder sign tokens?
It uses HMAC-SHA256 (HS256) with the secret you provide, computed by the browser Web Crypto API. The header and payload are Base64URL-encoded, then the signature is computed over “header.payload”.
Can I decode the token this tool makes?
Yes. Paste it into the JWT decoder on this site to see the header and payload as readable JSON, including any expiry timestamps converted to dates.
Is the payload secret?
No. Base64URL encoding is not encryption: anyone holding the token can decode and read the payload. Never include passwords, secrets or sensitive personal data in JWT claims.
Why HS256 only?
HS256 with a shared secret is the simplest signing method and the one most developers need for testing. Asymmetric algorithms such as RS256 need a private key, which should never be pasted into a browser tool.
Related Tools
- JWT Decoder – decodes JWT headers and payloads into readable JSON, locally
- HMAC Generator – Keyed hash (HMAC-SHA256) from key and message
- Base64 Encoder / Decoder – encodes text to Base64 and decodes it back, Unicode-safe
- JSON Formatter & Validator – beautifies JSON and pinpoints syntax errors when it will not parse