JWT Encoder

Generate and encode JWTs by injecting JSON payload and header.

Header (JSON)

Payload (JSON)

Secret Key (Optional)

Assemble a JWT-shaped token from JSON

A JSON Web Token is three Base64URL-encoded pieces joined by dots: header, payload and signature. This encoder builds the first two pieces from JSON you type, so you can see exactly how a token is put together. It suits learning, mocking, and creating sample tokens for front-end tests, but you should understand one important limit before using the output: the signature it produces is not a genuine cryptographic signature.

Creating a token

Edit the Header (JSON) box. It starts as an HS256 header of type JWT.
Edit the Payload (JSON) box, which starts with a subject and a name. Press Sample to load a payload containing a subject, a role of admin and an expiry timestamp.
Optionally fill Secret Key (Optional).
Click Process / Generate.

The token appears colour-coded, with the header in red, the payload in purple and the signature in green. Both JSON fields must be valid, or you get an error telling you so. Use Copy or Download for the result.

Read this before using the token

The header and payload encoding is real Base64URL, without padding, so those two segments will decode correctly in any JWT decoder. The third segment, however, is only a placeholder built from your secret text plus a fixed word, then Base64URL-encoded. It is not an HMAC-SHA256 signature, and the algorithm named in your header is not applied. A server that verifies signatures will reject these tokens. Because the placeholder is simple encoding, your secret text can be recovered from it, so do not enter a real secret. For a genuine signature, use a JWT library in your own code or the HMAC Generator to work through the signing input by hand.

Good uses

Demonstrating to a team how header and payload become the first two token segments.
Making dummy tokens for UI tests where the signature is never checked.
Trying out different claims and seeing how the encoded text changes.
Producing input to test a decoder or validator page.

Other limitations

Encoding uses the browser's standard Base64 function, which only handles characters in the basic Latin range; text containing emoji or non-Latin scripts may cause the encoding to fail. Timestamps you write, such as exp, are kept as you type them and are not calculated for you. There is no algorithm selector, and the Clear button found on other tools is not present here, so edit the boxes directly.

Related Tools

Frequently Asked Questions

Is the signature this tool generates real?

No. The third segment is a placeholder made from your secret text plus a fixed word, encoded as Base64URL. It is not an HMAC signature, so servers that verify signatures will reject the token. Use a JWT library for real signing.

Should I enter my real secret key?

No. Because the placeholder signature is only encoded text built from the secret, the secret can be read back from the token. Leave the field empty or use a dummy value, and never put production secrets into it.

Will the header and payload decode correctly elsewhere?

Yes. Those two segments are properly Base64URL-encoded without padding, so any JWT decoder, including the JWT Decoder on this site, will show your JSON. Only the signature part is not valid.

Why does encoding fail with special characters?

The encoder relies on the browser's basic Base64 function, which handles only Latin-range characters. Emoji or non-Latin text in the JSON can cause an error, so stick to ASCII when generating test tokens.

Can I use these tokens for testing?

Yes, for UI demos, mock APIs and decoder tests where the signature is not checked. They are not suitable for authentication, because a system that verifies signatures will not accept them.