Security tools
JWT Encoder (HS256)
Sign a JSON Web Token (JWT) with HS256, a keyed SHA-256 signature. The payload remains readable.
Runs locallyRuns locally in your browser
Guide
Enter a JSON (JavaScript Object Notation) object and a secret key of at least 32 bytes. Choose Sign to create a token with three parts. Anyone holding the token can read the payload. Signing does not encrypt it.
- Choose your input
Enter a JSON (JavaScript Object Notation) object and a secret key of at least 32 bytes.
- Read the result
Choose Sign to create a token with three parts. Anyone holding the token can read the payload. Signing does not encrypt it.
- Keep your result
On a phone, select Output. Copy or download only when you want to keep the result.
Try a signed token
Choose Example payload and Sign. Open JWT Decoder and paste the result to read its payload. Being able to read the payload does not prove that the signature is valid.
On mobile, choose Output to read the result. Clear removes both fields.
Key
- Use at least 32 bytes of unpredictable key material. The key is interpreted as exact UTF-8 text.
Shortcuts
- Ctrl / Cmd + Enter — Run selected action
- Ctrl / Cmd + Shift + C — Copy output
- Ctrl / Cmd + S — Download output
- ? — Show shortcuts outside text fields
Shortcuts work while focus is in the workspace. Copy and download need valid output.
Common questions
- Where is my input processed?
- In this browser. Input, keys, passwords and results are not stored or sent to a server.
- How do I clear my data?
- Choose Clear to remove entered data and results from this workspace.
- How does processing start?
- Choose the action above the fields. Changing an option clears the previous result.
Was this tool helpful?
Only your rating and optional feedback are sent. Your tool input and output are never included.