Encode a JWT (HS256)
Generate a JSON Web Token signed with HMAC-SHA256 from a JSON payload and a secret, which is handy for testing an API or debugging an authentication integration.
How it works
A JWT is made up of three Base64 URL-encoded parts separated by dots: a header describing the algorithm, a payload containing the data (the “claims”), and a signature that guarantees the token hasn't been modified. This tool computes the HMAC-SHA256 signature from your secret and assembles the three parts, exactly as an authentication server would.
Why should the secret never be shared?
The HMAC secret is what proves a JWT was issued by you. If someone else knows the secret, they can forge valid tokens in your name, for example by granting themselves administrator rights. Never reuse a production secret in an online testing tool.
Can this tool verify an existing JWT?
No, this tool is only for generating a new token from a payload and a secret. To verify a token you've received, you'd need to recompute its signature with the same secret and compare it with the one provided in the token.
100% local processing: the signature is computed entirely in your browser via WebAssembly. Neither the payload nor the secret is sent to a server.