Build and sign a JWT online

How it works

1. 1

   Edit the header JSON.

2. 2

   Edit the payload JSON with the claims you need.

3. 3

   Enter the signing secret.

4. 4

   Copy the generated token.

About the JWT Encoder

When you are testing an API that expects a JSON Web Token, it helps to make one with exactly the claims you need. This encoder takes a JSON header, a JSON payload and a shared secret, then builds a signed token with HMAC SHA-256. The token is rebuilt every time you edit a field, using the browser's Web Crypto API.

What you can do

• Edit the header and payload as JSON, starting from a sample token.
• Enter a secret and get an HS256-signed token right away.
• Add any claims you need, such as exp, roles or a custom tenant ID.
• Copy the finished token for use in an Authorization: Bearer header.

When it works best

• Testing how your API handles an expired token, a missing claim or an unexpected role.
• Creating tokens for local development when the real identity provider is not available.
• Learning how the header, payload and signature fit together.

Things to know

• Signing happens in the browser, but avoid typing production secrets into any web page.
• The signature is always HS256, whatever alg the header says; RS256, ES256 and other algorithms are not supported.
• The JSON is re-serialised without spaces, so the token encodes the same data even if your formatting differs.
• To read an existing token, use the JWT Decoder. To compute an HMAC on its own, use the HMAC Generator.

Frequently asked questions