JWT Encoder
Build and sign a JSON Web Token in your browser with HS, RS, PS, ES or EdDSA — or produce an unsecured "alg: none" token to inspect.
Payload (JSON)
Secret
Signing a token in the browser
Write the payload as JSON, choose an algorithm, supply a key, and the token is signed locally with the Web Crypto API. Nothing — not the payload, not the key — is transmitted.
HMAC algorithms (HS256/384/512) take a shared secret. RSA and ECDSA algorithms take a private key in PKCS#8 PEM form, the block that begins with "BEGIN PRIVATE KEY".
- HS256 — one shared secret, used by both signer and verifier. Simple, but every verifier can also mint tokens.
- RS256 / PS256 — sign with a private key, verify with a public one. The right choice when many services need to verify but only one should issue.
- ES256 — the same split with much smaller keys and signatures, at the cost of slightly less universal library support.
Frequently asked questions
My PEM key is rejected. What format is required?
Web Crypto needs PKCS#8. If your file starts with "BEGIN RSA PRIVATE KEY" it is PKCS#1; convert it with: openssl pkcs8 -topk8 -nocrypt -in key.pem -out pkcs8.pem
Should I generate production tokens here?
For testing, yes — nothing leaves the page. For production, tokens should be issued by your auth server, which holds the signing key and can revoke it.
How do I add an expiry?
Add an exp field to the payload with a Unix timestamp in seconds. The Epoch converter turns a date into that number.