Skip to main content

JWT Encoder / Signer

Create and sign a JSON Web Token in your browser with HS256, RS256, PS256, ES256 and EdDSA. Keys never leave the page.

Claims builder

Shortcuts: Ctrl+Enter run · Ctrl+Shift+C copy result · / search (use ⌘ on Mac)

Next steps

Done here? Use the Send to… menu on the result to carry it on to JWT Decoder, Base64URL & Base32 Converter or JSON Parser.

Free Online JWT Encoder and Signer

Write a header and payload, add the claims you need, choose an algorithm and get a signed token. Everything happens in your browser. It gives developers a quick browser-based way to solve a focused jwt encoder / signer task before moving the result into a project.

How to create a JWT

Choose an algorithm, edit the payload (and header if you need extra fields such as kid), add a secret or private key and press Sign. The claims builder adds iss, sub, aud, exp, iat and jti for you.

Test keys

Generate test key pair creates a secret (HS) or a new private and public key (RS, PS, ES, EdDSA) so you can sign and then verify the token elsewhere.

Common mistakes

  • The algorithm in the header always follows the dropdown. A different alg typed into the header is replaced.
  • Short secrets are accepted but weak: use at least 32 bytes for HS256.
  • exp and iat are in seconds since 1970, not milliseconds.

Frequently asked questions

Are my keys and secrets sent anywhere?
No. The token is signed with your browser's built-in Web Crypto. Keys and secrets stay on this page and are not stored.
Which algorithm should I use?
HS256 uses one shared secret and is simple for a single service. RS256 and ES256 use a private key to sign and a public key to verify, which suits tokens that other services check. EdDSA is modern and compact where browsers support it.
What key format does it need?
For HS algorithms, any secret text. For the others, a private key in PKCS#8 PEM form ("BEGIN PRIVATE KEY") or a private JWK. Use "Generate test key pair" to get a working pair.
Is a token made here safe for production?
The signature is real, but use this for testing and learning. Real tokens should be created by your server with a secret that is never pasted into a web page.
How do I use this jwt encoder / signer tool?
Use the interactive controls above; processing stays in your browser and the result is intended as a practical starting point for development work.

More Security & Auth

View all Security & Auth tools →