A secure, local JWT encoder
This jwt encoder allows developers to quickly draft, modify, and sign JSON Web Tokens directly in the browser. Whether you are building an authentication flow, testing an API endpoint, or debugging a microservice, you can generate valid tokens on the fly without writing custom scripts or exposing your credentials to third-party servers.
Because the tool relies on your browser's native Web Crypto API, all data processing and cryptographic signing happen entirely on your device. Your JSON payload and secret keys are never uploaded, stored, or logged. This local-first approach makes it safe to sign JWT online, even when working with sensitive development or staging credentials.
How to create a JWT token
To create a JWT token, you need three components: a header (which defines the algorithm), a payload (which contains your data), and a secret key (which secures the token).
Start by selecting your algorithm. This tool functions as a robust HS256 jwt generator, but also supports HS384 and HS512. These are symmetric HMAC algorithms, meaning the exact same secret key is used to sign the token and to verify it later. The higher the number (e.g., 512), the larger the resulting hash size, which provides stronger cryptographic security at the cost of a slightly longer token string.
Next, define your payload in the provided text area. The payload must be valid JSON. As you edit the JSON or update the secret key, the tool recalculates the signature in real-time, providing immediate feedback if there is a syntax error in your JSON structure. Once your payload and secret are set, the final token is ready to be copied and used in your application's Authorization headers or cookies.
Common use cases for generating tokens
Having a reliable jwt generator on hand is essential for modern web development. Developers frequently use this tool for a variety of testing and debugging scenarios:
Testing API Endpoints: When working with API clients like Postman or Insomnia, you often need a valid bearer token to access protected routes. Instead of running your entire frontend application to log in and fetch a token, you can manually generate one here with the exact user ID and roles you need.
Debugging Authentication Logic: If your backend is rejecting tokens, creating a token manually helps isolate the problem. You can verify whether the issue stems from an incorrect secret key, a malformed payload, or a mismatch in the signing algorithm.
Crafting Edge Cases: Testing how your backend handles expired tokens, missing claims, or unauthorized roles is crucial for security. You can easily manipulate the JSON payload here to create these edge cases and ensure your server responds with the correct HTTP status codes.
Managing timestamps and claims
JSON Web Tokens use specific fields, known as claims, to convey information about the token's lifecycle and the user it represents. The most common time-based claims are iat (Issued At) and exp (Expiration Time). Both of these claims require a Unix timestamp, which is the number of seconds that have elapsed since January 1, 1970.
Calculating these timestamps manually can be tedious during testing. To speed up your workflow, this tool includes quick-action buttons above the payload editor.
- Clicking iat = now instantly injects or updates the
iatfield with the current Unix time. - Clicking exp = +1h or exp = +24h calculates the future timestamp and updates the
expfield accordingly.
This ensures your generated tokens are immediately valid and won't be prematurely rejected by your server's time-validation logic.
Handling Base64 secrets
A common stumbling block when you try to sign JWT online is dealing with secret key encoding. Many backend systems and tutorials recommend generating a strong, random byte array for your HMAC secret and storing it as a Base64 string in your environment variables.
If your server decodes this Base64 string into raw bytes before signing or verifying the token, pasting the Base64 string directly into a standard generator will result in an invalid signature. The generator will treat the Base64 characters as plain text, leading to a mismatch.
To solve this, simply check the Secret is Base64 encoded box. The tool will decode your secret string into its original raw bytes before applying the HMAC hash, ensuring the resulting signature perfectly matches your backend environment.
Understanding the JWT structure
When you generate a token, the output is displayed in a color-coded format to help you understand its structure. A standard JWT consists of three parts separated by periods (.):
- Header (Red): Contains metadata about the token, primarily the signing algorithm (e.g.,
{"alg":"HS256","typ":"JWT"}). This is automatically generated based on your algorithm selection and Base64-URL encoded. - Payload (Blue): Your actual JSON data, also Base64-URL encoded. This part is easily readable by anyone who intercepts the token, which is why you should never put passwords or highly sensitive data in the payload.
- Signature (Green): The cryptographic hash of the encoded header and encoded payload, signed using your secret key. This guarantees that the token has not been tampered with in transit.
If you have an existing token and want to view its contents without the secret key, you can paste it into our JWT Decoder to inspect the header and payload safely.