JWT Encoder
Sign a JSON object into a compact HS256, HS384, or HS512 JSON Web Token in the browser. The HMAC secret stays in the tab, so you can mint a test token without posting it to a hosted encoder.
Runs in your browser. Nothing is uploaded.
About this tool
Sign a JSON object into a compact JSON Web Token with HMAC-SHA256, HMAC-SHA384, or HMAC-SHA512. The header is alg and typ JWT, plus an optional kid. The secret never goes to a server.
How to use: paste a JSON object, enter the HMAC secret, pick HS256, HS384, or HS512, and copy the token. An optional key id is written into the header as kid. Arrays and bare values are rejected.
Example: a payload with sub and name, plus the secret you type, becomes a three-part token. Paste that token into the JWT decoder on this site, with the same secret, to check the signature.
Signing uses the Web Crypto API in this tab. This tool does not create RSA or ECDSA tokens, and it does not offer the none algorithm. After the page loads, signing works offline.
FAQ
Related Crypto tools
Hash Generator
Generate cryptographic hashes (SHA-256, SHA-1, MD5, and more) from text using Web Crypto in your browser. Create checksums for files-as-text, compare digests, and copy hex output. Hashing never leaves the tab, so test strings and secrets stay private.
HMAC Generator
Compute HMAC-SHA signatures in the browser for webhook secrets and API signing. Paste a message and a key, pick SHA-1 through SHA-512, and copy hex or Base64. Keys stay in the tab.
JWT Decoder
Decode JSON Web Tokens locally to inspect the header, payload, and expiry claims. Paste a JWT and read Base64URL-encoded fields without verifying signatures on a remote service. Ideal for debugging auth flows while keeping tokens off the network.
AES Encrypt
Encrypt and decrypt text with AES-256-GCM in the browser. A password is stretched with PBKDF2; output is Base64(salt + IV + ciphertext). Useful for sharing a short secret over a side channel you control. Keys never leave the tab.
Secret Redactor
Redact JWTs, AWS keys, GitHub tokens, private keys, bearer tokens, and emails in pasted logs. Replacement happens in the tab.