In short: A JWT encoder builds a JSON Web Token by Base64URL-encoding a header and payload and signing them with a secret using HMAC (HS256, HS384 or HS512).
About JWT Encoder (HS256 Signer)
When you are building or testing an API that accepts JWTs, you often need a token with specific claims: an expired one, one with an admin role, one for a particular user ID. This encoder signs tokens with HMAC-SHA using the Web Crypto API built into your browser, producing exactly the same output as libraries like jsonwebtoken or PyJWT for the same header, payload and secret.
The token is updated as you type. Use the buttons to add an iat (issued at) claim set to the current time or an exp claim one hour ahead, both as Unix seconds as the JWT specification (RFC 7519) requires.
How to use JWT Encoder (HS256 Signer)
- Choose HS256, HS384 or HS512 and enter the shared secret your server uses for testing.
- Edit the payload JSON; add
iatorexpwith the buttons if needed. - Copy the token and send it in an
Authorization: Bearerheader.
Examples
The payload {"sub":"1234567890","name":"John Doe","iat":1516239022} signed with HS256 and the secret your-256-bit-secret produces a signature ending in …SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c, the same as the well-known example in the JWT introduction on jwt.io.
Set "exp" to a past timestamp such as 1600000000 to check that your API rejects expired tokens.
Frequently asked questions
Does it support RS256 or ES256?
Not yet. Asymmetric algorithms need a private key in PEM format; this tool covers the HMAC family, which is the most common for local testing.
Is my secret sent anywhere?
No. Signing happens with crypto.subtle in your browser. Still, use test secrets only. You can check this yourself: open your browser’s developer tools, switch to the Network tab and use the tool — no request carries your input.
Why does my server reject the token?
Check that the algorithm and secret match exactly (including whitespace), that exp is in seconds not milliseconds, and that any required claims such as aud or iss are present.
Is the payload encrypted?
No. A JWT payload is only Base64URL-encoded; anyone can read it. The signature proves it was not altered.
Updated November 2026 · Free, no signup · How we build and test tools