100% Client-Side

JWT Encoder

Create and sign JWT tokens with custom claims and headers

Free Client-Side No Login No Storage
Loading tool...
JWT Decoder & Inspector Decode and inspect JWT tokens — header, payload, claims at a glance HMAC Generator Generate HMAC message authentication codes — SHA256, SHA512, SHA1, MD5 Base64 Encoder Encode text or binary data to Base64 — standard and URL-safe variants

How to Use the JWT Encoder

  1. Enter a JSON payload with your claims.
  2. Choose an algorithm (HS256/384/512).
  3. Enter a secret key for HMAC signing.
  4. Click Create JWT to generate the token.

Uses the Web Crypto API for HMAC signing. Your secret never leaves the browser. For RS256/ES256, use a library like jose.js.

What is JWT Encoding?

The JWT Encoder allows developers to craft, encode, and digitally sign JSON Web Tokens (RFC 7519) directly in the browser. You can customize the header algorithm (HS256, HS384, HS512), configure custom payload claims (such as `sub`, `iat`, `exp`, and user roles), and compute standard HMAC-SHA signatures with a secret key.

Common Uses

  • Generating mock authentication tokens for backend API development and automated tests
  • Testing JWT expiration handling and role-based access control (RBAC) rules
  • Understanding the exact structural mechanics of JWT headers, payloads, and signatures
  • Creating signed bearer tokens for local development environments

Frequently Asked Questions

What algorithms are supported for signing JWTs?

The tool supports symmetric HMAC algorithms including HS256, HS384, and HS512. It creates valid cryptographic signatures conforming to the RFC 7519 specification.

What are the standard claims in a JWT payload?

Standard registered claims include `iss` (issuer), `sub` (subject), `aud` (audience), `exp` (expiration time), `nbf` (not before), and `iat` (issued at). You can freely add custom claims for application roles and IDs.

Is it safe to generate tokens with sensitive keys here?

Yes. Aya Corporation operates 100% client-side. Your secret signing key and payload claims are processed in your local browser memory and never transmitted over the internet.

Notes from this implementation

HMAC only, on purpose

This script signs with Web Crypto HMAC: HS256, HS384, or HS512. The header is {"alg":"...","typ":"JWT"} and the signing input is the two Base64URL segments joined by a dot. It does not offer RS256. If you need an RSA signature, the HMAC page will not get you there by pasting a PEM into the secret box. The secret is a raw string, not a PEM.

The encoder on this page and the builder page overlap. Use this one when you already have a JSON payload and a symmetric secret and you want a token you can paste into the decoder. Use the builder when you are assembling claims one field at a time. Neither page stores the secret. Both pages will sign whatever payload you type, including alg confusion tests. A token minted here is only as trustworthy as the secret you typed.