100% local and secure
Your data stays on your device and is never sent to our servers.
JWT Encoder
Enter a header, payload, and secret to generate an HMAC JSON Web Token without network requests.
- 100% local
- Instant
- Free
- No account
- Works offline
- Clipboard
Data not sent
Data not sent
Algorithm
Do not use a production secret on a shared or untrusted device.
Signed JWT
Why use this tool?
Create a locally signed JWT with HS256, HS384, or HS512 from a header, payload, and secret.
Smart processing
Generate or verify sensitive data with clear and immediate controls.
Supported formats
Strings, keys, hashes, and technical formats depending on the security function.
Save time
Get a clean, ready-to-use result in seconds without installing software or configuring a complex workflow.
Fonctionnement
How does this tool work?
The encoder validates both JSON objects, updates the selected algorithm in the header, and converts the header and payload to Base64URL. It then signs the two segments with HMAC through Web Crypto and assembles the three token parts entirely in the browser.
Use cases
Create a test token
Generate a local JWT for API development and testing.
Verify an implementation
Compare an application token with a known reference output.
Prepare a demonstration
Explain the header, payload, and signature structure of a JWT.
Guide
How to use this tool
- 1
Enter the data
Fill in the fields or paste the information required for the operation.
- 2
Configure the process
Choose the options, formats, or algorithms that fit your use case.
- 3
Use the result
Generate and copy the locally produced report, code, or value.
Tips and best practices
- Avoid entering production secrets on a shared device.
- Always review generated output before using it in a real environment.
- All operations are performed locally in your browser.
Frequently asked questions
Are data sent to a server?
No. Processing runs locally in your browser and the entered information is not transmitted.
Can generated results be copied?
Yes. Every generated output can be copied directly for reuse in code or documentation.
Can I use sensitive data?
Processing is local, but production secrets should still be avoided on shared or untrusted devices.
Was this tool useful?
Read next
GuideBest practicesBeginner
JWT: understand structure, signature, expiration and common mistakes
Learn what a JWT contains, why decoding is not verification, how claims such as exp, nbf, iss and aud work, and common security mistakes.
29 August 20261 minRead
GuideBest practicesBeginner
HTTP security headers: which ones to enable and why
Understand HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy and how to verify the headers actually returned.
29 August 20261 minRead
GuideBest practicesBeginner
Web security: understand the essential protections of a website
Understand the layers that protect a website: HTTPS, HTTP security headers, CSP, SRI, authentication, passwords and integrity.
29 August 20262 minRead
TutorialBest practicesBeginner
How to securely redact a PDF before sharing it
Learn why covering text is not enough, how secure PDF redaction removes sensitive information and why sanitization matters before sharing.
10 September 20262 minRead
Recommended workflow
Continue your processing
Discover tools that naturally fit before, after, or alongside this one.
Complementary tools
Security & privacy
Basic Auth Generator
Generate an HTTP Basic Auth header and usage examples.
100% local
Use this toolSecurity & privacy
JWT decoder
Decode a JWT to inspect its header, payload, and main token information more easily.
100% local
Use this toolSecurity & privacy
JWT inspector
Inspect a JWT to review its header, payload, timestamps, and main token information.
100% local
Use this tool