JWT Encoder

A JWT encoder builds a JSON Web Token from a header and a payload and signs it with a secret or private key. It is useful for testing APIs, reproducing authentication bugs, writing integration tests, and learning how tokens work, without writing any code.

The token is assembled as base64url(header) + "." + base64url(payload), and the signature is computed over that string. Open the result in the JWT Decoder to inspect and verify it.

{
  "iss": "https://auth.example.com",
  "sub": "user_12345",
  "aud": "https://api.example.com",
  "scope": "read:orders write:orders",
  "iat": 1767225600,
  "exp": 1767229200
}

• All common algorithms

  Sign with HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, and EdDSA (Ed25519).

• Live signing

  The token is re-signed as you edit the header, payload, or key, with exact line and column errors for invalid JSON.

• One-click time claims

  Set iat and nbf to now, or exp to 15 minutes, 1 hour, 1 day, or 30 days from now, and see the dates in plain English.

• Flexible keys

  Use a text or Base64 secret, a PEM private key (PKCS#8, PKCS#1, or SEC1), or a private JWK.

• Test key pairs

  Generate an RSA, EC, or Ed25519 key pair in your browser and copy the public key to verify the token.

• Private by design

  Signing uses the browser's Web Crypto API. Secrets, keys, and tokens never leave your device.

1. Choose the signing algorithm. The alg field in the header updates automatically.
2. Edit the payload JSON and use the shortcuts to set iat, nbf, and exp.
3. Enter a secret (HS algorithms) or paste a private key. Click Generate Key Pair to create a test key.
4. Copy the signed token, or open it in the JWT Decoder to verify it.