JWT Encoder (HS256)
Enter a JSON payload and a secret to generate a signed JWT using HS256, via the browser's Web Crypto API. This is a testing/development tool — never use a real production secret here, and never share tokens signed with a real secret with anyone.
Neither the secret nor the token's content is ever sent to a server — signing happens entirely inside your browser via the Web Crypto API.
This is a testing/development tool (HS256) — never use a real production secret here, and never share tokens signed with real secrets with anyone.
What this tool does
Generates a JWT signed with HS256 from a payload and secret you supply, for use in testing and development.
When to use it
- Testing an endpoint that requires a valid token without going through a full sign-in.
- Trying different claims in the payload to see how your application responds.
- Learning how a JWT is assembled and signed.
How to use it
- Write the payload as JSON.
- Enter the secret used for signing.
- Generate the token and copy it.
A practical example
Input
A payload with a subject, a name and an issued-at time, plus a test secret.
Output
A three-part JWT signed with HS256, usable in your test environment.
Limitations
- This is a testing and development tool: never put a real production secret in it, and never share tokens signed with real secrets with anyone. The interface warns you about this directly.
- HS256 is the only supported signing algorithm; asymmetric algorithms such as RS256 are not offered.
- The token is valid to anyone holding the same secret, so a weak secret means a weak token.
- The payload is encoded rather than encrypted, so keep sensitive data out of it even in testing.
Privacy and processing
Signing happens inside your browser, and neither the secret nor the payload is sent to any server.
Technical notes
- The signature is computed with HMAC and SHA-256 through the browser's built-in cryptography interface.