So nutzt du: JWT Encoder
- Choose the signing algorithm — HS256 for a shared secret, RS256 or ES256 for a private key.
- Edit the payload JSON and add claims such as
iatandexpwith the buttons. - Enter the secret, or paste a PKCS#8 private key for RS/PS/ES algorithms.
- Copy the encoded token, or open it in the decoder to inspect it.
How a JWT is built
A JSON Web Token (RFC 7519) has three Base64url parts separated by dots: header.payload.signature. The signature is computed over the first two parts, so any change to the header or claims invalidates it. The payload is only encoded, not encrypted — anyone can read it, so never put secrets in a JWT.
Choosing an algorithm
| Algorithm | Key | When to use |
|---|---|---|
| HS256 / HS384 / HS512 | Shared secret (HMAC) | One service both issues and verifies tokens |
| RS256 / RS384 / RS512 | RSA private key, public key to verify | Many services verify; widest library support (OAuth, OpenID Connect) |
| PS256 | RSA with PSS padding | Like RS256 with a more modern padding scheme |
| ES256 / ES384 | EC private key (P-256 / P-384) | Short signatures and keys; Apple and many modern APIs |
Registered claims
ississuer,subsubject (user ID),audaudienceiatissued at,nbfnot before,expexpiry — all in seconds since 1970 (Unix time; see the timestamp converter)jtiunique token ID, useful for revocation lists
Secrets and keys
RFC 7518 requires HMAC keys at least as long as the hash: 32 random bytes for HS256. Short human-readable secrets can be cracked offline from a single token. Private keys must be in PKCS#8 PEM (BEGIN PRIVATE KEY); convert older formats with openssl pkcs8 -topk8 -nocrypt. Inspect existing tokens with the JWT decoder.
Auch gesucht als: jwt generator, create jwt, jwt encode, sign jwt online, jwt builder, generate jwt token, rs256 jwt.
Passende Tools zu: JWT Encoder
- RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
- HMAC Generator — Compute keyed HMAC signatures for API requests and webhooks, and check whether a received signature is valid — using your browser’s Web Crypto API.
- Base64-Kodierung / -Dekodierung — Konvertiere Text in Base64 und zurück – mit vollständiger UTF-8-Unterstützung (Akzente, Emojis), wechsle zu URL-sicheren Base64-Werten oder zieh eine Datei per Drag & Drop hinein, um deren Base64-Zeichenkette oder Daten-URI zu erhalten.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
Häufige Fragen
Is it safe to create JWTs here?
Signing happens in your browser with the Web Crypto API; secrets and keys are never sent. Use test keys for experiments, not production signing keys.
Why does RS256 reject my private key?
Web Crypto needs PKCS#8 (“BEGIN PRIVATE KEY”). Keys starting with “BEGIN RSA PRIVATE KEY” are PKCS#1 — convert them with
openssl pkcs8 -topk8 -nocrypt -in key.pem.Can I encrypt the payload?
Signed JWTs (JWS) are readable by anyone. Encrypted tokens use JWE, a different format not covered by this tool.
What does exp mean?
The expiry time in Unix seconds. Servers reject the token after that moment. The +1 h and +1 day buttons set it relative to now.
Kann ich JWT Encoder als Web-App installieren und offline nutzen?
Ja. JWT Encoder ist eine installierbare Web-App (PWA) – sie wird über Ihren Browser installiert und nicht aus einem App-Store heruntergeladen. Klicken Sie oben auf dieser Seite in Chrome oder Edge (Windows, macOS, Linux, ChromeOS) auf „App installieren“ oder verwenden Sie auf Android-Geräten „Teilen“ → „Zum Startbildschirm hinzufügen“ auf dem iPhone und iPad bzw. „Datei“ → „Zum Dock hinzufügen“ in Safari 17+ auf einem Mac. Die App öffnet sich dann in einem eigenen Fenster mit einem eigenen Symbol, und da sie vollständig in Ihrem Browser ausgeführt wird, funktioniert sie auch offline. Firefox auf dem Desktop kann keine Web-Apps installieren. So funktioniert die Installation.