JWT Encoder & Builder
Build JWT token strings for testing workflows and optionally sign with local HMAC algorithms.
Runs locally in your browser.
Review important security-sensitive data and configurations independently.
Never enter production secrets into a tool unless you understand and trust the environment. This tool processes inputs locally where supported.
Advanced header fields (optional)
Signing key is required for signed mode.
Encoded token
Base64URL encoding and token construction are not the same as trust validation. Signature verification must be handled by your authentication system.
Use in code
Construct and optionally sign JWTs. For trust decisions, always verify signatures on receipt.
Create and sign an HS256 JWT
TypeScriptPrimary API
new SignJWT(payload).setProtectedHeader(header).sign(key)
Builds token claims and signs with an HMAC key for local integration testing.
Install
import { SignJWT } from "jose";
const secret = new TextEncoder().encode("replace-with-secret");
const payload = { sub: "user-123", role: "admin" };
const token = await new SignJWT(payload)
.setProtectedHeader({ alg: "HS256", typ: "JWT" })
.setIssuedAt()
.setExpirationTime("2h")
.sign(secret);
console.log(token);Reference: jose documentation
How to use
- Choose algorithm and token type to auto-update the header JSON.
- Edit payload claims and optional custom header fields.
- For signed mode, enter a shared secret and click Encode.
Use cases
- Create sample tokens for local integration testing.
- Rebuild token structure quickly when debugging claims.
- Pair with JWT Decoder to inspect generated token segments.
Examples
- Header example: {"alg":"HS256","typ":"JWT"}.
- Payload example: {"sub":"user-123","role":"admin"}.
- With alg=none, output is unsigned token construction for learning/testing.
Limitations and caveats
- Unsigned mode encodes structure only and does not provide authenticity.
- Even signed output must still be verified by your authentication system.
History
- JWT and JWS specifications define how token headers, claims, and signatures are represented compactly.
- Developer tooling for JWT construction emerged to simplify testing of claims and token parsing behavior.
- Builder tools are commonly paired with decoders to inspect generated headers and payloads during development.
Evolution and improvements
- JWT builders evolved from manual scripts to interactive tools with header templates and claim editors.
- Modern browser implementations can perform local HMAC signing via Web Crypto APIs when supported.
- Current best practice keeps construction and cryptographic trust decisions explicit and separate.
Source: Web Crypto API · RFC 7515