JWT Encoder
Build a JWT from a header and payload.
How to use JWT Encoder
Encode a JWT header and payload, optionally signing it with HS256 when you supply a secret.
Open JWT Encoder on toolpermarket and fill in the inputs the tool asks for.
In the Header (JSON) field, the JWT header, usually {"alg":"HS256","typ":"JWT"}. alg HS256 signs with a secret; none produces an unsigned token.
In the Payload (JSON) field, the claims object you want to encode. Keep it valid JSON — expired or numeric fields are fine as values.
In the Secret (optional) field, a shared secret used to sign with HS256. Leave blank for an alg:none token with no signature.
Press Encode to compute the result. The output appears immediately below the form. Adjust the inputs and recalculate as many times as you need.
Read the result and use it as needed. If the number looks off, re-check your inputs and run it again — the math is deterministic, so the same entries always return the same answer.
Worked example. Header {"alg":"HS256","typ":"JWT"} and payload {"sub":"123","name":"Jane"} with secret "secret" yields a signed three-part token.
Tips for accurate results.
With a secret the token is signed using HS256 via the Web Crypto API.
Without a secret you get an unsigned token (alg: none) for testing only.
The signature is base64url-encoded and joined with dots.
When to use JWT Encoder. Building a sample token for a local auth test. Checking how your library expects header and payload. Teaching the JWT structure without a server.
When you actually reach for this
- You are building or testing an auth flow and need to craft a JWT with specific claims to send to a service.
- You want to generate a token locally to reproduce what your backend issues, for debugging.
Where this tool stops being accurate
- Encoding signs the token only if you supply the correct secret/key; an unsigned or wrongly-signed token will be rejected by a real verifier.
- Putting sensitive data in the payload is unsafe — the payload is readable by anyone holding the token.
Frequently asked questions
Is the secret sent anywhere?
No. Signing happens on your device with the Web Crypto API; the secret stays in the page and is never uploaded.
What does an unsigned token mean?
With alg none and no secret the token has an empty signature segment. It is useful for testing decoders but must never be trusted in production.
Why might signing fail?
If the header or payload is not valid JSON, or the browser lacks the Web Crypto API, signing is skipped and you get the unsigned form instead.
Can I create a valid JWT without the server secret?
Only a "none" or self-signed token, which compliant verifiers reject. For real auth, the backend must sign with its own secret or private key.
Should I put the user's email in the JWT?
You can, but remember it is visible to anyone with the token. Never put passwords or secrets in claims; keep PII minimal.