JWT Encoder Online — Generate JSON Web Tokens in Your Browser

Create and sign JSON Web Tokens (JWTs) directly in your browser using HS256 (HMAC-SHA256). Provide a JSON header, JSON payload, and a secret key — the encoder uses the Web Crypto API (SubtleCrypto) for cryptographically secure signing. No data is ever uploaded. Perfect for testing authentication flows, generating mock tokens for development, and learning JWT structure hands-on.

• Browser-Native Crypto: Uses crypto.subtle.sign() — the same API used in production web apps.
• HS256 Signing: HMAC-SHA256 is the most widely supported JWT algorithm, used by Auth0, Firebase, and most backend frameworks.
• Zero Dependencies: No external library — runs in any modern browser without installing anything.
• Dev & Test Ready: Instantly generate test tokens for local development, Postman collections, and integration test fixtures.

⚠️ Never use real production secrets in any online tool. Use this encoder only with test secrets for development and learning purposes.

How JWT Signing Works: The HS256 Algorithm

HS256 (HMAC with SHA-256) is a symmetric signing algorithm — a single secret key is used both to sign and to verify the token. Here's exactly what the JWT encoder does when you click "Generate":

1. Serialize the header and payload objects to JSON strings.
2. Base64URL-encode both strings: encodedHeader and encodedPayload.
3. Concatenate them with a dot: signingInput = encodedHeader + "." + encodedPayload.
4. Compute HMAC-SHA256(signingInput, secret) using SubtleCrypto.
5. Base64URL-encode the 32-byte signature digest.
6. Return the final JWT: encodedHeader.encodedPayload.signature.

The resulting token can be verified by any JWT library that knows the same secret — jsonwebtoken in Node.js, PyJWT in Python, or the golang-jwt package in Go.

JWT Encoder in Code: Node.js, Python & Java

Use these battle-tested libraries to generate JWTs programmatically in your application backend:

const jwt = require('jsonwebtoken');

const token = jwt.sign(
  {
    sub: 'user_123',
    name: 'Jane Doe',
    roles: ['admin'],
  },
  process.env.JWT_SECRET,
  {
    algorithm: 'HS256',
    expiresIn: '1h',
  }
);

import jwt
import time

payload = {
    "sub": "user_123",
    "name": "Jane Doe",
    "roles": ["admin"],
    "iat": int(time.time()),
    "exp": int(time.time()) + 3600,
}

token = jwt.encode(
    payload,
    os.environ["JWT_SECRET"],
    algorithm="HS256",
)

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

String token = Jwts.builder()
  .setSubject("user_123")
  .claim("name", "Jane Doe")
  .claim("roles", List.of("admin"))
  .setIssuedAt(new Date())
  .setExpiration(
    new Date(
      System.currentTimeMillis()
      + 3_600_000
    )
  )
  .signWith(SignatureAlgorithm.HS256,
    secretBytes)
  .compact();

JWT Claims Design: What to Put in the Payload

Designing a good JWT payload is critical for security and performance. Here are the key principles for JWT token generation in production systems:

• Always set exp: Tokens without an expiration are active until the key is rotated. Use short-lived tokens (15–60 minutes) with refresh token rotation for user sessions.
• Keep payloads small: JWTs are attached to every request. Large payloads increase bandwidth. Include only the claims your application actually reads — typically sub, roles, and a few custom claims.
• Never include sensitive data: Passwords, credit card numbers, SSNs, or any PII have no place in a JWT payload — the payload is only Base64URL-encoded, not encrypted.
• Use jti for one-time tokens: Include a unique JWT ID claim to enable token blacklisting and prevent replay attacks in high-security flows.
• Scope-based authorization: Following OAuth 2.0 patterns, store permissions as a scope string ("read:users write:posts") or a roles array for RBAC systems.

RS256 vs HS256: Choosing the Right JWT Algorithm

The choice between symmetric (HS256) and asymmetric (RS256 / ES256) signing algorithms is architectural. Our online JWT generator supports HS256 — the right choice for many use cases: