Online JWT encoder

Sign JWTs from JSON header and payload with HS, RS, PS, or ES in the browser.

About this online JWT encoder

hidevtool JWT encoder signs JSON Web Tokens in your browser: edit header and payload JSON, choose HS or RS/PS/ES algorithms, and copy the compact token with syntax-colored output.

Private keys and secrets never leave your device—signing happens locally.

Online JWT encoder capabilities

What does this encoder do?

It builds a standard three-part JWT from your header and payload JSON, computes the signature with your key, and updates the token live as you edit fields.

Pick an algorithm

  1. HS256 / HS384 / HS512 — symmetric HMAC; use a strong shared secret.
  2. RS256 / RS384 / RS512 — RSA with PKCS#1 v1.5 padding.
  3. PS256 / PS384 / PS512 — RSA-PSS (often preferred for new RS deployments).
  4. ES256 / ES384 / ES512 — ECDSA with P-256, P-384, or P-521 curves.

Header & payload tips

  • Include typ: "JWT" and alg matching your selected algorithm.
  • Add exp (and iat) as Unix seconds for realistic test tokens.
  • Keep payload small—large claims inflate every request header.
  • Custom claims are fine; avoid putting secrets in the payload.

Key formats

  • HMAC — paste the UTF-8 secret string used by your API.
  • RSA / EC — paste a PKCS#8 PEM private key (BEGIN PRIVATE KEY).

Security tips

  1. 1Use test keys only; never paste production private keys on shared machines.
  2. 2Prefer RS/ES or strong HS secrets; avoid short or guessable HMAC passwords.
  3. 3Set short exp for access tokens; use refresh flows in real applications.
  4. 4Store private keys in HSM/KMS in production—this tool is for local dev and QA.
  5. 5Verify tokens with the JWT debugger on the same site after signing.

Common use cases

Local API testing

Mint bearer tokens for Postman or curl against a dev API that expects JWT auth.

Microservice stubs

Generate signed tokens with custom claims to simulate users and roles in integration tests.

Learning JWT

See how alg and claims change the header and signature bytes with immediate visual feedback.

Frequently asked questions

Which algorithms can I use to sign a JWT?
This page can sign JWTs with the following header algs in your browser (12 total): HMAC (symmetric secret): HS256, HS384, HS512 RSA PKCS#1 (PKCS#8 PEM private key): RS256, RS384, RS512 RSA-PSS (PKCS#8 PEM private key): PS256, PS384, PS512 ECDSA (PKCS#8 PEM private key): ES256, ES384, ES512 Not supported: alg "none", EdDSA (e.g. Ed25519), and other algs not listed. Private keys must be PKCS#8 PEM (BEGIN PRIVATE KEY).
How do I encode a JWT online?
Choose an algorithm, paste header and payload JSON, enter your secret or private key, and copy the generated token from the output field.
Which private key format is supported?
PKCS#8 PEM (BEGIN PRIVATE KEY) for RS, PS, and ES algorithms. Legacy PKCS#1 RSA PEM may need conversion.
Is my signing key uploaded?
No. Encoding runs entirely in your browser; nothing is uploaded.
Can I decode tokens on hidevtool too?
Yes. Use the JWT debugger tool on the same site to decode and verify tokens.