JWT Encoder
Build and sign a JSON Web Token with HMAC (HS256, HS384 or HS512) using the Web Crypto API — signing happens entirely in your browser, and the secret never leaves this page.
How to use
- Edit the header and payload JSON — change the alg field if you pick a different algorithm below.
- Enter the signing secret and choose HS256, HS384 or HS512.
- Click Sign token and copy the resulting JWT.
Note: HMAC secrets must stay secret — anyone holding the secret can forge tokens. This tool is for development and testing; production tokens should be signed on a server.
Tips
- Use a long, random secret — short or guessable secrets make HMAC-signed tokens easy to forge.
- Keep the payload small: tokens travel in HTTP headers, so large claims slow down every request.
- Include an exp claim (expiry timestamp) so tokens stop working after a set time.