Como usar: JWT Encoder
- Choose the signing algorithm — HS256 for a shared secret, RS256 or ES256 for a private key.
- Edit the payload JSON and add claims such as
iatandexpwith the buttons. - Enter the secret, or paste a PKCS#8 private key for RS/PS/ES algorithms.
- Copy the encoded token, or open it in the decoder to inspect it.
How a JWT is built
A JSON Web Token (RFC 7519) has three Base64url parts separated by dots: header.payload.signature. The signature is computed over the first two parts, so any change to the header or claims invalidates it. The payload is only encoded, not encrypted — anyone can read it, so never put secrets in a JWT.
Choosing an algorithm
| Algorithm | Key | When to use |
|---|---|---|
| HS256 / HS384 / HS512 | Shared secret (HMAC) | One service both issues and verifies tokens |
| RS256 / RS384 / RS512 | RSA private key, public key to verify | Many services verify; widest library support (OAuth, OpenID Connect) |
| PS256 | RSA with PSS padding | Like RS256 with a more modern padding scheme |
| ES256 / ES384 | EC private key (P-256 / P-384) | Short signatures and keys; Apple and many modern APIs |
Registered claims
ississuer,subsubject (user ID),audaudienceiatissued at,nbfnot before,expexpiry — all in seconds since 1970 (Unix time; see the timestamp converter)jtiunique token ID, useful for revocation lists
Secrets and keys
RFC 7518 requires HMAC keys at least as long as the hash: 32 random bytes for HS256. Short human-readable secrets can be cracked offline from a single token. Private keys must be in PKCS#8 PEM (BEGIN PRIVATE KEY); convert older formats with openssl pkcs8 -topk8 -nocrypt. Inspect existing tokens with the JWT decoder.
Também pesquisado como: jwt generator, create jwt, jwt encode, sign jwt online, jwt builder, generate jwt token, rs256 jwt.
Ferramentas que combinam com: JWT Encoder
- RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
- HMAC Generator — Compute keyed HMAC signatures for API requests and webhooks, and check whether a received signature is valid — using your browser’s Web Crypto API.
- Codificação/Decodificação Base64 — Converte texto para Base64 e vice-versa, com suporte total a UTF-8 (acentos, emojis); alterna para Base64 seguro para URLs; ou arrasta um arquivo para obter sua string Base64 ou URI de dados.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
Perguntas frequentes
Is it safe to create JWTs here?
Signing happens in your browser with the Web Crypto API; secrets and keys are never sent. Use test keys for experiments, not production signing keys.
Why does RS256 reject my private key?
Web Crypto needs PKCS#8 (“BEGIN PRIVATE KEY”). Keys starting with “BEGIN RSA PRIVATE KEY” are PKCS#1 — convert them with
openssl pkcs8 -topk8 -nocrypt -in key.pem.Can I encrypt the payload?
Signed JWTs (JWS) are readable by anyone. Encrypted tokens use JWE, a different format not covered by this tool.
What does exp mean?
The expiry time in Unix seconds. Servers reject the token after that moment. The +1 h and +1 day buttons set it relative to now.
Posso instalar o JWT Encoder como um aplicativo da web e usá-lo offline?
Sim. O JWT Encoder é um aplicativo da web instalável (PWA) — instalado a partir do seu navegador, não baixado de uma loja de aplicativos. Clique em “Instalar aplicativo” na parte superior desta página no Chrome ou no Edge (Windows, macOS, Linux, ChromeOS) ou, no Android, use “Compartilhar” → “Adicionar à tela inicial” no iPhone e no iPad, ou “Arquivo” → “Adicionar ao Dock” no Safari 17+ em um Mac. Em seguida, ela se abre em uma janela própria com seu próprio ícone e, como é executada inteiramente no seu navegador, continua funcionando offline. O Firefox no desktop não permite a instalação de aplicativos da web. Como funciona a instalação.