Digital ToolPad.

Runs 100% in your browser

Your data never leaves your device. zero uploads.

JWT Encoder

Build and sign test JWTs from editable header and payload JSON with HS, RS, PS and ES algorithms.

Header (algorithm & type)
Loading...
Payload (data claims)
Loading...
Verify Signature

Working with JWT Encoder

Create signed test tokens from editable JSON sections. Review each claim and the alg header before copying the token into a development fixture. Use your real authentication system for production token issuance.

How to use JWT Encoder

  1. Edit the JSON in the Header and Payload editors.
  2. Choose the algorithm and enter an HS secret or a PKCS#8 private key in the Verify Signature box.
  3. Copy the signed token from the Encoded box once the badge shows it verifies.

JWT Encoder example

Set "sub" to a test user and "exp" to a time one hour ahead in seconds, keep HS256 and enter a test secret. The signed token updates on the left and the badge shows "Signature Verified".

What to expect from the result

RS, PS and ES signing needs an unencrypted PKCS#8 private key (BEGIN PRIVATE KEY). Without one, the tool shows the unsigned header and payload with the message "Invalid private key format for signing." Keys stay in your browser, but use test keys here rather than production signing keys.

JWT Encoder questions

How do I use JWT Encoder?

Edit the Header and Payload JSON, choose an algorithm, and enter an HS secret or a PKCS#8 private key in the Verify Signature box. The signed token updates in the Encoded box as you type. The badge then verifies the new token, using the public key derived from your private key for RS, PS and ES.

Which key do I need to sign RS256, PS256 or ES256 tokens?

RS, PS and ES tokens need a PEM private key in PKCS#8 format, starting with BEGIN PRIVATE KEY. Convert BEGIN RSA PRIVATE KEY or BEGIN EC PRIVATE KEY files with openssl pkcs8 -topk8 -nocrypt. A public key cannot sign, so with one the tool shows the unsigned token and "Invalid private key format for signing."

100% private: your data never leaves your browser

No registration, no tracking of your content, no server uploads. Don't just take our word for it:

  • No server, no uploads

    Your files and text are processed entirely on your device. Nothing is ever sent to us.

  • Works offline

    Once loaded, this tool keeps working with your Wi-Fi turned off. Try it.

  • Verify it yourself

    Open your browser's DevTools → Network tab. You'll see zero requests carrying your data.

Explore more tools

More utilities for your next task.

Browse all tools