JWT Encoder

Create and sign JWT tokens with HS256 from a header, payload and secret — free JWT encoder.

About

About the JWT Encoder

Builds and signs a JSON Web Token from a header, payload and secret, using the HS256 (HMAC-SHA256) algorithm via the browser's own Web Crypto API.

Backend developers use it to hand-craft a token for testing an API without spinning up a full auth server, while students learning how JWTs work use it to see exactly how the header, payload and signature fit together. It's one of many free developer tools on Toolapt, and like every tool here, it's free to use with no sign-up and no limit on how many times you run it.

Choose what to view about this tool

Guide

Using the JWT Encoder

  1. 1

    Step 1

    Edit the Header (JSON) field, or leave the default HS256/JWT header as-is.

  2. 2

    Step 2

    Edit the Payload (JSON) field with the claims you want the token to carry.

  3. 3

    Step 3

    Enter a secret to sign the token with.

  4. 4

    Step 4

    Click "Generate JWT" to get the signed token, then Copy it or Clear to start over.

  • Signs tokens with real HMAC-SHA256 (HS256) via the browser's built-in Web Crypto API, not a fake approximation
  • Freely editable header and payload JSON, so you can add or remove claims before signing
  • Produces a standard three-part, base64url-encoded token ready to paste into an Authorization header
  • Your header, payload and secret are processed entirely on your own device — nothing is sent to a server
  • Free to use, with no limit on how many times you run it
  • Fully responsive, so it works just as well on a phone as on a desktop

Backend developers

Backend developers use the JWT Encoder for hand-crafting a test token with specific claims to exercise an API's auth checks without running a full identity provider.

QA and API testers

QA and API testers use the JWT Encoder for generating tokens with expired, missing or malformed claims to verify an endpoint rejects them correctly.

Students learning JWTs

Students learning JWTs use the JWT Encoder for seeing exactly how a header and payload get base64url-encoded and signed into a token.

DevOps engineers

DevOps engineers use the JWT Encoder for quickly producing a one-off signed token to test a service-to-service call during debugging.

Examples

JWT Encoder examples

4 worked examples

01

Minimal signed token

With header {"alg":"HS256","typ":"JWT"}, payload {"sub":"123"} and secret "test-secret", clicking Generate JWT produces a standard 3-part header.payload.signature token.

02

Custom claims added

Edit the payload to {"sub":"1234567890","name":"Ada Lovelace","admin":true} and the token regenerates instantly with those claims encoded and signed.

03

Different secret, different signature

Keep the same header and payload but change the secret from "abc" to "xyz", and the signature segment changes completely while the header and payload segments stay identical.

04

Invalid payload JSON

Leave the payload missing a closing brace and clicking Generate JWT shows an error instead of a token, so you can fix the JSON and try again.

Related tools

JWT Decoder

Read the header and payload of a JSON Web Token, including expiry times.

Use it

cURL to Code Converter

Paste a curl command and get the same request as JavaScript, Python or Node.js code.

Use it

.gitignore Generator

Pick the languages and tools you use and get a merged .gitignore file.

Use it

.env / JSON Converter

Convert environment variables between .env file format and a JSON object.

Use it

SemVer Parser and Comparator

Break a semantic version into its parts, and compare two versions.

Use it

Git Command Cheat Sheet

A searchable quick reference for the git commands you use most.

Use it

FAQ

Frequently asked questions

Quick answers to common questions about the JWT Encoder.

What does the JWT Encoder do?

It builds a JSON Web Token from a header and payload you edit as JSON, and signs it with a secret you provide, using the HS256 (HMAC-SHA256) algorithm.

Is the JWT Encoder free to use?

Yes. It's free, with no sign-up, no watermark and no limit on how many times you use it.

Is my secret safe when I use this tool?

Yes. The header, payload and secret you enter are processed entirely on your own device using the browser's Web Crypto API — nothing is sent to a server.

Which signing algorithms does it support?

Only HS256 (HMAC-SHA256) for now. It's the most common algorithm for shared-secret JWTs; RS256 and other public-key algorithms aren't supported.

What happens if my header or payload isn't valid JSON?

The tool shows an error message instead of generating a token, so you can fix the JSON before trying again.

Can I use this to verify a token I received from somewhere else?

No. This tool only encodes and signs a new token from a header and payload you provide — it doesn't decode or verify an existing token's signature.

Can I use the JWT Encoder on my phone?

Yes. The page is fully responsive and works on mobile, tablet and desktop browsers alike.

Does the JWT Encoder have any limitations?

It's built for everyday HS256 token creation and testing; it doesn't support asymmetric algorithms or custom header fields beyond standard JSON editing.

Still have a question? Contact us

Report a problem

JWT Encoder

What went wrong?
    or paste a screenshot