🎟️JWT Encoder

About this tool

Edit the payload claims, choose the algorithm, use the expiry helper to stamp iat and exp, and enter a secret. The signed token appears colour-coded — header, payload, signature — with human-readable claim times and a warning if the secret is too short. Copy it for your API client or test suite.

How a JWT is built

A JSON Web Token is three Base64url-encoded parts joined by dots: a header naming the algorithm, a payload of claims, and a signature over the first two. With HS256 the signature is HMAC-SHA256 using a shared secret, so any server holding the secret can verify the token and trust its claims. Standard claims include sub (subject, usually a user ID), iat (issued at), exp (expiry) and nbf (not before), all times in seconds since 1970. This encoder is for development: testing an API locally, mocking an auth server, writing integration tests. Important limits: a JWT's payload is encoded, not encrypted — anyone can read it, so never put passwords or personal data in it; only the shared-secret HS algorithms are supported here, not RS256 or ES256, which use key pairs; and you should never paste a production signing secret into a website, this one included. Use a long random secret (at least 32 characters for HS256), which the password generator can make. The JWT decoder reads tokens, the HMAC generator shows the raw signature, the timestamp converter reads iat and exp, and What a JWT is, what's inside one, and what it does and doesn't prove explains the format.

Frequently asked questions