JWT Encoder & Signer
Build and sign a JSON Web Token with HMAC, RSA, or ECDSA — entirely in your browser.
Signed token
Enter a payload and a secret to sign a token.
Note:
- Signing runs locally via Web Crypto — your secret never leaves your browser
algandtypare written into the header for you, so a token can never claim one algorithm while being signed with another- RS* and ES* need a PKCS#8 private key (the
-----BEGIN PRIVATE KEY-----form), not a public key - A JWT is signed, not encrypted — anyone can read the payload, so never put secrets in it
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The JWT Encoder builds and signs a JSON Web Token from claims you control. Choose HMAC (HS256/384/512) with a shared secret, or RSA (RS*) and ECDSA (ES*) with a PKCS#8 private key, then edit the payload as plain JSON. The signed token regenerates as you type, so it's well suited to producing fixture tokens for tests, reproducing an auth bug, or checking what your API does with a particular set of claims.
The alg and typ header fields are written from your algorithm selection rather than taken from your input — a token can never advertise one algorithm while being signed with another, which is the shape of the classic alg: none confusion attack. Helper buttons insert iat and exp as correct Unix timestamps. Signing uses the browser's Web Crypto API, so your key never leaves your machine. To inspect an existing token instead, use the JWT Decoder.
FAQ
Pick an algorithm, enter your secret or private key, and edit the payload JSON. The signed token is produced instantly and updates as you type.
A PKCS#8 private key — the block starting with -----BEGIN PRIVATE KEY-----. A public key or an old PKCS#1 "BEGIN RSA PRIVATE KEY" block will not import.
No, and that's deliberate. The alg and typ header fields are written from the algorithm you select, so a token can never advertise one algorithm while being signed with another. You can still add other header claims like kid.
Use the "exp = +1h" button to insert an expiry one hour out, or add exp manually as a Unix timestamp in seconds. The "iat = now" button sets the issued-at claim the same way.
No. A signed JWT is Base64URL-encoded, not encrypted — anyone holding the token can read its payload. Never put passwords or personal data in the claims.
No. Tokens are signed locally with the browser's Web Crypto API, so your secret or private key never leaves your device.