How do I use the JWT encoder (HS256)?
- Enter the payload as JSON.
- Enter a test secret and the expiry in minutes.
- Copy the token and decode it with our JWT decoder to check.
JWT encoder (HS256): frequently asked questions
Is it safe to use?
Signing happens in your browser. Still, use only test secrets — never production keys.
Which algorithm is used?
HS256 (HMAC with SHA-256), the most common shared-secret algorithm.
What are iat and exp?
Issued-at and expiry times, in seconds since 1970. They are added automatically.
Can I make RS256 tokens?
Not yet. RS256 needs a private key, which you should generate and keep on your server.
How do I verify the token?
Your server checks the signature with the same secret. Our JWT decoder shows the header and payload.
Is a JWT encrypted?
No. The payload is only Base64URL-encoded — anyone can read it. Never put secrets in it.
Is there an API for this tool?
Selected tools are available through a rate-limited public API. Contact us if you need higher volumes.
Is the jwt encoder (hs256) free?
Yes. It is free with no sign-up and no usage limits for normal use.
Is my data sent to your servers?
No. This tool runs entirely in your browser, so what you type never leaves your device.
Does it work on my phone?
Yes. The tool works in any modern browser on iPhone, Android, tablet or computer.