Which algorithms are supported?

HS256, HS384, and HS512 (HMAC + SHA). These are the most common symmetric algorithms. We do not support RSA or ECDSA public-key signing in this client-only tool.

What is the structure of a JWT?

Three Base64URL-encoded parts joined by dots: header (algorithm and type), payload (claims), and signature (HMAC of header and payload using your secret).

Can I decode the token I just created?

Yes — the preview shows the encoded token. To inspect the decoded header and payload, use our separate JWT Decoder tool.

When should I use HS256 vs RS256?

HS256 uses a shared secret — good when the same party issues and verifies tokens (typical single-service setups). RS256 uses a private key to sign and a public key to verify — better when multiple services must verify tokens without being able to forge them (e.g. OAuth providers).

Should I include an exp claim in every token?

Yes. Without exp, a token is valid forever — a serious security risk if it leaks. Use short expirations (15 minutes to 1 hour) for access tokens, and a longer refresh token to renew them.

JWT Encoder

Create and sign JSON Web Tokens with HS256, HS384 or HS512 — all locally in your browser via the Web Crypto API. Edit the header, add claims to the payload, enter your secret, and copy the signed token. Your secret never leaves your device.

How to use

Edit the header

Set the algorithm (HS256, HS384, HS512). The type is JWT by default.

Edit the payload

Add your claims — user ID, roles, expiry, and any custom data.

Enter your secret

Type the secret key used to sign the token.

Generate and copy

Click Generate token and copy the signed JWT.

Header

Payload

Algorithm

Secret

Signing runs 100% locally using Web Crypto API. Your secret never leaves your device. For production, always store secrets in environment variables.

Features

Three HMAC algorithms

HS256, HS384 and HS512 — the most common symmetric signing algorithms.

Local signing

Signing uses the Web Crypto API — your secret never leaves your device.

Editable header and payload

Full control over the claims and algorithm.

Instant output

The signed JWT appears as soon as you click Generate.

Common use cases

Generate a test JWT for API debugging
Create a token with custom claims for development
Learn how JWT signing works
Produce a token to test your own JWT decoder

Frequently Asked Questions

Related tools

JWT Decoder

Hash Generator

Base64 Encoder & Decoder

UUID Generator