Is HS256 secure enough?

For internal service-to-service auth with a high-entropy secret (≥ 32 random bytes), yes — HS256 is widely used and well-vetted. For public APIs where each client should hold its own key, prefer asymmetric signing (RS256/ES256) so you do not have to share the verification secret.

Why is there no RS256 / ES256 in this tool?

Asymmetric signing needs a private key, and pasting a private RSA/EC key into any web page is a bad habit we will not encourage. Use openssl or a server-side library (jose, pyjwt, jjwt) for RS256/ES256. This tool sticks to HMAC where the failure mode is bounded to your test secret.

Can I include kid or other custom fields in the header?

Yes — the header is a free-form JSON editor. Add kid, cty, x5t, or any custom claim. The tool will base64url-encode whatever valid JSON you write and use it verbatim in the signing input.

Why does my decoded token show a different signature than someone else's?

HMAC is deterministic given the same header, payload, and secret — so a different signature means one of those three differs. The usual culprits are a trailing newline in your secret, different JSON whitespace (we minify before signing), or a different algorithm.

How long should my secret be?

RFC 7518 requires the secret to be at least the hash output size — 32 bytes for HS256, 48 for HS384, 64 for HS512. Use a random secret (openssl rand -base64 32), not a human password. Short or guessable secrets defeat the whole point of signing.

JWT Encoder — Sign HS256 / HS384 / HS512

Encode JWT — pick algorithm (HS256/HS384/HS512), set header/payload/secret, get token.

Runs locally
Category Encoding & Crypto
Best for Checking small payloads, tokens, hashes, and encoded values quickly.

Algorithm

Header (JSON)

Payload (JSON)

Secret

Stays in your browser. HS256/384/512 need a random secret — never a password.

Encoded JWT

—

What this tool does

Free online JSON Web Token encoder. Pick HS256, HS384, or HS512, edit the header and payload as JSON, type a secret, and copy the signed token. Signing runs in your browser via SubtleCrypto HMAC — your secret never touches our servers. Use it as the reverse of the JWT decoder for testing APIs locally.

Tool details

Input: Files + Text + Structured content; The page exposes text boxes, numeric controls, file pickers, or structured inputs depending on the tool.
Output: Live result + Copy; The result area focuses on usable output, with copy, download, or preview actions when supported.
Privacy: Browser-side processing; The main tool logic does not call an external API, so inputs normally stay in the current tab.
Save / share: No account required; Open the page and use it; whether results survive refresh depends on the tool.
Performance budget: Initial JS <= 18 KB; No WASM budget is declared, keeping the tool quick to open on mobile.
Best fit: Encoding & Crypto · Developer; Category and role tags drive related tools, internal links, and quick fit checks.

How to use

1. Input

Paste or drop your content into the tool panel.
2. Process

Click the button. All processing is local in your browser.
3. Copy / Download

Copy the result or download to disk in one click.

How JWT Encoder fits into your work

Use it for quick browser-side encoding, decoding, hashing, token checks, and share-safe transformations.

Encoding jobs

Checking small payloads, tokens, hashes, and encoded values quickly.
Preparing values for APIs, URLs, docs, or support tickets.
Avoiding account-based tools when the input might be sensitive.

Encoding checks

Do not paste live secrets unless you are comfortable with local browser handling.
Confirm whether the operation is reversible before sharing the result.
For hashes, compare the exact algorithm and casing expected by the receiver.

Good next steps

These links move the current task into a more complete workflow.

FAQ

Tool combos

Folks in your role tend to reach for these alongside this tool.

Developer

Browse all tools for this role

JWT Encoder — Sign HS256 / HS384 / HS512

What this tool does

Tool details

How to use

1. Input

2. Process

3. Copy / Download

How JWT Encoder fits into your work

Encoding jobs

Encoding checks

Good next steps

FAQ

JWT Decoder

Base64 Encoder & Decoder

MD5 / SHA Hash Generator

HTML Entities Encoder

Bcrypt Generator

Number Base Converter

Color Blindness Simulator

Color Contrast Checker

Color Converter

AES Text Encryptor

Atbash Cipher

Bacon Cipher Encoder & Decoder