🔑

JWT Encoder

Encode JWT tokens with custom payload and secret

89 visits

JWT Encoder takes the JSON payload and secret you provide, adds an iat (issued-at) claim automatically and an exp (expiry) claim if you set one, then signs the token with HMAC-SHA256 using the Web Crypto API — producing a real, working JWT you can use for testing.

Enter JSON: {"payload": {"sub": "user123"}, "secret": "my-secret", "expiresInSeconds": 3600}

How to use JWT Encoder

  1. 1

    Enter your payload as a JSON object.

  2. 2

    Enter the secret to sign with.

  3. 3

    Optionally set an expiry time.

  4. 4

    Copy the signed JWT.

Everything you need to know about creating JWTs

What does encoding a JWT involve?

Building a JWT means assembling a header and payload, then signing the combination with a secret key — that signature is what lets a server later verify the token wasn't altered after it was issued.

When you actually need this

  • Testing an API that requires a JWT, without spinning up your actual auth service.
  • Understanding how a specific token was constructed, by building one yourself with known values.

A security note

Never use a real production signing secret in a third-party tool — use a throwaway test secret, since anyone with the actual signing secret can forge valid tokens for your real system.

Related Developer Tools

{ }

JSON Formatter

Format, validate and beautify JSON with syntax highlighting

148 0
{ }

JSON Minifier

Minify and compress JSON by removing whitespace

88 0
🌳

JSON Viewer

Interactive tree view for exploring complex JSON data

82 0
📋

XML Formatter

Format and validate XML documents

76 0
📋

YAML Formatter

Format, lint and validate YAML files

93 0
🔀

CSV to JSON

Convert CSV files or data to JSON format

90 0

Frequently Asked Questions

What signing algorithm does this use?

HS256 (HMAC with SHA-256) — a symmetric algorithm where the same secret is used to sign and later verify the token. It's the most common default for simple JWT setups.

What gets added to my payload automatically?

An iat claim (issued-at, the current Unix timestamp) is always added. If you set an expiry, an exp claim is added too, calculated as the current time plus however many seconds you specify.

Is the secret I enter stored anywhere?

No — it's used only to compute the signature for this one request and isn't stored. Still, use a test secret rather than a real production signing key, since it is transmitted to generate the token.

Does this tool send my payload and secret to a server?

Yes — they're sent to our servers to sign the token and the result is returned to you; nothing is stored.

Is this tool free to use?

Yes — completely free, with no signup and no usage limits for casual use.