📌 Overview

Build a signed JWT (header.payload.signature) using HMAC-SHA256. Enter a JSON payload and a secret — signing happens in your browser.

🔐 JWT Encoder

Build a signed JWT (header.payload.signature) using HMAC-SHA256. Enter a JSON payload and a secret — signing happens in your browser.

🔒 All processing happens in your browser. No data is uploaded to any server.

📖 Deep Dive: JWT Encoder

JWT structure

A JWT has three parts joined by dots: header (algorithm and type), payload (claim data), and signature.

Signing process (HS256)

1. base64url-encode the header and payload.

2. Concatenate data = encHeader + "." + encPayload.

3. Apply HMAC-SHA256 to data using the secret.

4. base64url-encode the signature to get token = data + "." + sig.

Important reminders

  • A JWT is signed, not encrypted; the payload can be read by anyone.
  • Do not put sensitive information in the payload.
  • This tool signs only in your local browser; the secret is not uploaded.