JWT Encoder
Build a new JSON Web Token from a header and payload, and sign it with HMAC — entirely in your browser, for testing your own JWT integrations.
Initializing JWT Studio...
JWT Studio
How to Use the JWT Encoder
Write a header and payload as JSON, choose HS256, HS384, or HS512, and enter a secret key to get back a correctly-signed JSON Web Token — computed entirely in your browser via the Web Crypto API. This is for testing and debugging your own application’s JWT handling, not for producing access to systems you don’t already control.
- 01
Choose an Algorithm
HS256, HS384, or HS512 — your selection always becomes the signed token’s "alg" field, regardless of what you type in the header box.
- 02
Write the Header & Payload
Edit the header and payload as JSON. The payload defaults to a familiar example ("sub", "name", "iat") you can replace entirely.
- 03
Enter a Secret & Copy the Token
Your secret signs the token locally and is never logged, stored, or sent anywhere. Copy the resulting token to use in your own testing.
Frequently Asked Questions
Answers about this tool.
Is my secret key uploaded anywhere?
No. Signing happens entirely inside your browser using the Web Crypto API. Your secret and payload are never sent to a server.
Can I generate an unsigned ("alg: none") token with this tool?
No. The algorithm you select is always what actually signs the token — this tool cannot produce an unsigned or "none"-algorithm token, even if you type that into the header field yourself.
Will a token I generate here work as a real login for another app?
Only if that app is configured to trust the exact secret you used to sign it. This tool is for testing your own JWT integration, not for creating access to a system you don’t control the secret for.
Can this tool sign with RS256/ES256 (RSA/ECDSA)?
Not yet — this baseline supports HMAC signing (HS256/384/512) only. Asymmetric algorithm support is a planned follow-on, since it requires careful private-key handling to do safely.
Related tools
JWT Decoder & Verifier
Decode a JWT’s header, payload, and signature, inspect its claims, and verify an HMAC signature.
Open toolAll JWT Studio tools
Decode a JSON Web Token’s header, payload, and signature, check its claims, verify an HMAC signature, or build and sign a new token. It uses your browser’s Web Crypto API and runs entirely on your device.
Open tool
