JWT encoder
Type a JSON payload, choose the algorithm, and type the secret or paste the private key: the signed JSON Web Token appears below, ready to copy.
Payload and header
The payload is a JSON object with the claims you want, such as sub, name, iat and exp (times in Unix seconds). It starts as an example issued now and expiring in an hour, and Times from now sets iat and exp again. The header is made for you, {"alg": "…", "typ": "JWT"}, and both are written compactly, as tokens usually are.
Beside the token: its algorithm and when it expires.
Algorithms and keys
- HS256, HS384, HS512: signed with a shared secret, typed as text
- RS256, RS384, RS512 and PS256, PS384, PS512: an RSA private key
- ES256, ES384, ES512: an elliptic curve private key (P-256, P-384, P-521)
- EdDSA: an Ed25519 private key
Paste a private key as PEM (-----BEGIN PRIVATE KEY-----, PKCS #8) or as a JWK. An older RSA or EC key file (BEGIN RSA PRIVATE KEY) converts with openssl pkcs8 -topk8 -nocrypt -in key.pem. The key is used only while the page is open, and never saved.
Check it
Paste the token into the JWT decoder, below the encoder, to read it back and check its signature with the secret or the public key.
Private: on your device
Tokens are read, checked and signed in your browser, by Web Crypto. Nothing is sent anywhere, and neither tokens nor keys are saved: leaving the page forgets them.
Questions
Should I paste a production signing key here?
It never leaves your browser and is never saved, but a production key belongs where your services keep it. For tests, use a test key or a secret made for the purpose (the secret key generator makes one).
How do I set an expiry?
Set "exp" in the payload to the time it expires, in Unix seconds. Times from now makes it an hour from now; the Unix timestamp converter gives any other time.