This tool builds a signed JSON Web Token from a payload and a secret using HS256. It encodes the header and payload, computes the HMAC-SHA256 signature with your secret, and assembles the complete token — all in your browser, so the secret is never transmitted.
How to use it
- Enter your payload as JSON (the claims).
- Enter your signing secret.
- A signed HS256 token is produced.
- Copy it to use in your tests or requests.
About JWT Encoder
Sometimes you need to produce a token, not just read one — to test an endpoint that expects a JWT, to reproduce a bug, or to understand how signing works. This encoder takes your claims and secret, builds the standard header, and signs the token with HMAC-SHA256 using the Web Crypto API. Because it runs locally, your secret stays on your device. The natural companion is a JWT decoder for inspecting tokens; together they let you work with JWTs end to end. As always, treat tokens you sign here as test artifacts and keep production secrets out of any tool you do not control.
FAQ
Which algorithm does it use?
HS256 — HMAC with SHA-256 — the most common symmetric JWT signing algorithm, using your secret as the key.
Is my secret uploaded?
No. The token is signed in your browser with the Web Crypto API; the secret never leaves your device.
Can I verify this token elsewhere?
Yes. Any HS256 verifier with the same secret will accept it.