E Encoder.guru
All tools Features
JWT · HMAC · CLIENT-SIDE

JWT Builder & Signer

Create and sign JSON Web Tokens with HS256, HS384, or HS512. Set standard claims, add custom payload, and verify signatures — all in your browser via the Web Crypto API.

🔒 100% client-side · secret never leaves this browser

Header & Secret

Claims (Payload)

Generated JWT

JWT appears here after clicking Sign
DECODED

          

          
Fill in the claims and click Sign

        

      

    


    
    
  

        
  

    
Related tools

    

      
        
          

            

            
SHA-256 Hash

          

          
Generate SHA-256 hash of any text.

        
        
          

            

            
SHA-512 Hash

          

          
Generate SHA-512 hash of any text.

        
        
          

            

            
MD5 Hash

          

          
Compute MD5 hash of any text.

        
        
          

            

            
HMAC Generator

          

          
Compute keyed HMAC with SHA-256/512.

        
    

  

        
What is a JSON Web Token (JWT)?

  
A JWT is a compact, URL-safe means of representing claims between two parties. It consists of three Base64url-encoded parts separated by dots: Header (algorithm), Payload (claims), and Signature. JWTs are widely used for authentication and API authorization.

  
HMAC signing algorithms

  
HS256 uses HMAC with SHA-256, HS384 with SHA-384, and HS512 with SHA-512. All three are symmetric — the same secret is used to sign and verify. For asymmetric signing (RS256, ES256), you would need a public/private key pair which is not supported by this tool.

  

    
Is it safe to sign JWTs here?
This tool uses the browser's native Web Crypto API. Your secret key never leaves your browser. That said, never use real production secrets in online tools as a general rule. This tool is best for development and testing.

    
What is the exp claim?
The exp (expiration) claim is a Unix timestamp (seconds since epoch) after which the token should not be accepted. Setting expiry is strongly recommended in production — tokens that never expire become a security liability if compromised.