JWT Encoder Online Free – Generate HS256/384/512 Tokens

🔑 ➜ 🎫

JWT Encoder Online Free

Create signed JSON Web Tokens instantly — HS256, HS384 or HS512, live claims editing with one-tap exp/iat helpers, custom headers, and built-in decode verification. Signing happens in your browser — your secret never leaves your device.

✓ HS256/384/512 · ✓ exp/iat Helpers · ✓ Decode Verification · ✓ Private

🎫 JWT Token Generator

🔧 JS ⏳ · Claims — · Sign — · Engine ⏳

Payload (Claims JSON)

Standard claims: sub (subject), name, iat (issued at), exp (expires, Unix seconds)

Algorithm HS256 (HMAC-SHA-256) HS384 (HMAC-SHA-384) HS512 (HMAC-SHA-512)

Secret key

Show secret

Custom header (advanced)

Header JSON — must include alg (HS256/384/512) and typ {"alg":"HS256","typ":"JWT"}

Your JWT

✅ Decode Verification — decoded from the generated token itself

🧩 How a JWT is built

A JWT is three Base64URL parts joined by dots:

header.payload.signature

• Header — the algorithm + token type
• Payload — your claims (data)
• Signature — HMAC of header.payload using your secret; this is what makes the token tamper-proof

---

⚠️ Important: JWTs are signed, not encrypted — anyone can read the payload. Never put passwords or secrets inside claims. And as good practice, avoid pasting production signing secrets into any web tool; use a test secret here.

How to Generate a JWT Online — 3 Easy Steps

1️⃣

Edit Your Claims

Fill the payload JSON with your data — use the one-tap exp/iat helpers to add standard time claims in Unix seconds.

2️⃣

Choose Algorithm & Secret

Pick HS256, HS384 or HS512 and enter a signing secret. Advanced? Override the full header JSON.

3️⃣

Generate & Verify

Press Generate — the signed token appears with an automatic decode-verification panel proving header and payload round-trip.

Why Use This JWT Generator?

🔐

Real HMAC Signing

Genuine HS256/384/512 signatures via the Web Crypto API — the same primitive your backend uses.

🧪

Decode Verification

Every generated token is immediately decoded back on screen — you see exactly what servers will read.

⏱️

exp / iat Helpers

One tap adds correctly-formatted Unix-time expiry and issued-at claims — no timestamp hunting.

🎛️

Custom Headers

Need kid, typ extras or non-standard header fields? Override the full header JSON.

🔒

Secret Stays Local

Signing runs entirely in your browser via JavaScript — the secret is never sent, stored, or logged.

♾️

Unlimited & Free

Generate as many tokens as you like — no account, no limits, works offline after load.

Popular Use Cases

• 🧪 Create test tokens while developing API authentication
• 🔍 Learn JWT structure by watching claims become a signed token
• 🎫 Generate short-lived demo tokens for client demos and tutorials
• 🧩 Debug signature mismatches by comparing generated tokens with your backend's
• 📚 Teach authentication flows with live, verifiable examples
• ⚙️ Produce expired/expiring tokens to test refresh logic (exp helper)

Pro Tips for Working with JWTs

• exp and iat are Unix seconds — not milliseconds. The helpers here insert the correct format; mixing this up is the classic "token instantly expired" bug.
• Signature protects integrity, not secrecy: anyone can base64-decode the payload. Sign sensitive actions; never store secrets in claims.
• Match your backend's algorithm: a token signed HS256 will be rejected by a server expecting HS512 — the header tells it which to verify.
• Shorter secrets aren't safer to type: use long random strings for real systems, and a throwaway value for testing here.
• Base64URL ≠ Base64: JWTs use URL-safe alphabet (- and _ instead of + and /) with no padding — that's why the middle parts look slightly "wrong" to standard Base64 decoders.

Frequently Asked Questions

Edit the payload claims, choose an algorithm, enter a secret, and press Generate. The tool base64url-encodes header and payload, computes the HMAC signature with your secret, and joins all three parts with dots — a complete, verifiable JWT.

HS256 means the signature is an HMAC using the SHA-256 hash, keyed with your secret string. It's the most common JWT algorithm — symmetric, fast, and supported everywhere. HS384 and HS512 are the same construction with stronger SHA variants.

No — a JWT is signed, not encrypted. Anyone who receives the token can decode the header and payload (that's how servers read your claims without the secret). Only the signature is unforgeable without the key. For confidentiality you'd need JWE encryption, which is a different standard.

It's HMAC(algorithm-hash, secret, base64url(header) + "." + base64url(payload)). Change even one character of the payload and the signature stops matching — which is exactly how servers detect tampering.

iat (issued at) records when the token was created, and exp (expiration) records when it stops being valid — both as Unix timestamps in seconds. Servers reject tokens whose exp has passed. The helper buttons insert both in the correct format.

Technically yes — signing runs entirely in your browser and nothing is transmitted or stored. But as universal security hygiene, avoid pasting production secrets into any web page; use a dedicated test secret here and keep real keys in your server's environment.

The dots separate the three parts, and the "strange characters" are Base64URL encoding — a URL-safe variant of Base64 that swaps + for - and / for _ and drops padding, so tokens can travel inside headers and URLs unchanged.

This tool verifies tokens it generates via the decode panel. Paste any generated token's parts back into the payload box to edit them, and check the Base64 section — or use our Base64 Decoder for raw part inspection.