JWT encoder.
Write the header and claims, choose HS256, RS256, ES256 or another algorithm, and sign with a secret or a private key. The token, and the public key to check it, come out in your browser.
JWT encoder.
Need the UI around it? With Pro, your AI agent builds the form, the result card and the rest of the page from a prompt.
Get ProHow it works
4 steps, no account. It runs in your browser and nothing is uploaded.
Write the claims
The header and payload as JSON, with buttons for iat, exp, nbf and jti.
Pick the algorithm
HS256 with a shared secret, or RS256, ES256 and the rest with a private key.
Give the key
Paste one, or generate a secret or a key pair on the spot.
Copy the token
The signed token, and the public key for whoever verifies it.
Related tools
More security and dev tools. Every one free, in the browser.
Pricing
Build it with Pro
The tool is free. Pro adds 6,000+ blocks, premium templates and the MCP server, so your AI editor builds the product around it.
4.9/5 out of 5 · 150+ reviewsfrom 150+ founders and developers.
- Secure checkout via Stripe
- Code lives in your repo
- Keep what you've shipped if you cancel
- License terms
Questions and answers
Before you trust the result: what to know about the format, the limits, your data and the tools next to it.
The header and the payload are written as JSON, each Base64url-encoded, joined by a dot, and that string is signed: an HMAC with a shared secret for HS256, an RSA or ECDSA signature with a private key for RS256 and ES256. The signature, Base64url too, is the third part.
HS256 when the same service issues and checks the token: one secret, fast. RS256 or ES256 when others must verify without being able to issue: they get the public key, you keep the private one. ES256 keys and signatures are much shorter than RSA's.
Integrity, not secrecy. Anyone holding the token can read its claims, so never put a password or personal data you wouldn't show the user in the payload. Signing also can't revoke a token: keep exp short.
At least as many bytes as the hash: 32 random bytes for HS256, 48 for HS384, 64 for HS512 (RFC 7518 §3.2). A short or guessable secret can be brute-forced offline from any token it signed. Generate secret draws one of the right size.
Edit the header and the payload, use the buttons to set iat, nbf, exp and jti, pick the algorithm, then give a secret or a private key. The token updates as you type.
Paste a PKCS#8 PEM (BEGIN PRIVATE KEY), a PKCS#1 RSA key or a private JWK, or press Generate key pair. The matching public key is shown as a PEM and a JWK for whoever verifies the token.
No. Signing runs in your browser with the Web Crypto API; the page makes no request with your claims, secret or key. Use test keys here, not your production signing key.
Nothing. The JWT encoder holds your input in the page's memory, so closing or reloading the tab clears it, and it saves nothing in this browser.
Closest to the JWT encoder: JWT decoder, RSA key generator, Random string generator, Base64 encoder. Each opens on its own page, free and in the browser.
The JWT encoder is one of 20 in its group. The group's page, /tools/security, lists them all.
The tool is free. Its interface is built from shadcn.io's own components (Button, Input, Slider and the rest of the registry under /ui), which come in React, Vue, Svelte and Solid. Pro adds the blocks and templates for the product around it.
4.9 out of 5 from 150+ developers
Build the product around it
Every block, template and icon, installed by your AI agent in your theme. The tools stay free.
Get Pro