How to use the JWT Encoder
- Choose the signing algorithm — HS256 for a shared secret, RS256 or ES256 for a private key.
- Edit the payload JSON and add claims such as
iatandexpwith the buttons. - Enter the secret, or paste a PKCS#8 private key for RS/PS/ES algorithms.
- Copy the encoded token, or open it in the decoder to inspect it.
How a JWT is built
A JSON Web Token (RFC 7519) has three Base64url parts separated by dots: header.payload.signature. The signature is computed over the first two parts, so any change to the header or claims invalidates it. The payload is only encoded, not encrypted — anyone can read it, so never put secrets in a JWT.
Choosing an algorithm
| Algorithm | Key | When to use |
|---|---|---|
| HS256 / HS384 / HS512 | Shared secret (HMAC) | One service both issues and verifies tokens |
| RS256 / RS384 / RS512 | RSA private key, public key to verify | Many services verify; widest library support (OAuth, OpenID Connect) |
| PS256 | RSA with PSS padding | Like RS256 with a more modern padding scheme |
| ES256 / ES384 | EC private key (P-256 / P-384) | Short signatures and keys; Apple and many modern APIs |
Registered claims
ississuer,subsubject (user ID),audaudienceiatissued at,nbfnot before,expexpiry — all in seconds since 1970 (Unix time; see the timestamp converter)jtiunique token ID, useful for revocation lists
Secrets and keys
RFC 7518 requires HMAC keys at least as long as the hash: 32 random bytes for HS256. Short human-readable secrets can be cracked offline from a single token. Private keys must be in PKCS#8 PEM (BEGIN PRIVATE KEY); convert older formats with openssl pkcs8 -topk8 -nocrypt. Inspect existing tokens with the JWT decoder.
Tools that pair well with the JWT Encoder
- RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
- Base64 Encode / Decode — Convert text to Base64 and back with full UTF-8 support (accents, emoji), switch to URL-safe Base64, or drop a file to get its Base64 string or data URI.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- Bcrypt Generator & Checker — Create bcrypt hashes for test users, seed data or config files, and check whether a password matches a stored hash — without sending either anywhere.
Frequently asked questions
Is it safe to create JWTs here?
Signing happens in your browser with the Web Crypto API; secrets and keys are never sent. Use test keys for experiments, not production signing keys.
Why does RS256 reject my private key?
Web Crypto needs PKCS#8 (“BEGIN PRIVATE KEY”). Keys starting with “BEGIN RSA PRIVATE KEY” are PKCS#1 — convert them with
openssl pkcs8 -topk8 -nocrypt -in key.pem.Can I encrypt the payload?
Signed JWTs (JWS) are readable by anyone. Encrypted tokens use JWE, a different format not covered by this tool.
What does exp mean?
The expiry time in Unix seconds. Servers reject the token after that moment. The +1 h and +1 day buttons set it relative to now.