What the encoder does
A JSON Web Token has three parts joined by dots: a header, a payload and a signature. The encoder turns your header and payload JSON into Base64URL text, then signs them with the algorithm and key you choose. The result is a compact token you can use for testing APIs, learning how JWTs work, or checking another system.
Algorithms
- HS256, HS384, HS512: HMAC with a shared secret. The same secret signs and verifies.
- RS256, RS384, RS512: RSA signatures. Paste a private key in PKCS#8 PEM format, the one that starts with BEGIN PRIVATE KEY.
- ES256, ES384, ES512: ECDSA signatures on the P-256, P-384 and P-521 curves, also with a PKCS#8 private key.
- none: an unsecured token with no signature. Use it only for testing, and never accept it in production.
Using your own key
For an HMAC algorithm, type the secret. Tick the Base64 option if your secret is stored Base64 encoded. For RSA or ECDSA, paste the PEM private key. If your key starts with BEGIN RSA PRIVATE KEY or BEGIN EC PRIVATE KEY, convert it with openssl pkcs8 -topk8 -nocrypt, because browsers need the PKCS#8 form.
Check the claims
Numbers such as exp, nbf and iat are Unix times in seconds. The claims builder helps you set them. The header builder covers fields such as kid. For a form-based shortcut, use create token.
Privacy
Signing happens in your browser using the built-in Web Crypto API. Nothing is sent to a server. Even so, avoid pasting real production secrets or keys into any website, and use test keys where you can.
New to the format? Read what a JWT is.