JWT Encoder — Sign HS256 / HS384 / HS512

Real-world use cases

• Forge a test token to hit a staging API without standing up an auth server

  Your backend verifies HS256 with a shared secret like dev-only-secret. Paste that secret here, set payload to {"sub":"42","role":"admin","exp":1735689600}, and copy the token straight into a curl -H "Authorization: Bearer ...". You skip the whole login dance and still exercise the real middleware path in under 30 seconds.

• Reproduce a "signature invalid" bug a teammate reported on their machine

  They claim the same payload yields a different token. Sign it here with their exact secret, then compare byte for byte. Nine times out of ten the diff is a trailing newline in their .env secret or JSON whitespace they did not minify. Two minutes of side-by-side encoding beats an hour of Slack back-and-forth.

• Build an expired token on purpose to test your 401 handling

  To confirm your refresh flow fires, you need a token whose exp is already in the past. Set {"sub":"u1","exp":1577836800} (Jan 2020), sign it, and feed it to your endpoint. A correct server returns 401 and triggers the refresh; if it returns 200, your expiry check is broken and you just caught it before users did.

• Demo HMAC tampering in a security talk or onboarding session

  Sign a payload with role:"user", show the token, then change the secret by one character and re-sign. The signature changes completely, proving why an attacker who flips role to admin in the payload but lacks the secret can never produce a valid token. It is a concrete 60-second demo that lands better than a slide of math.

Common pitfalls

• Pasting a production secret to "just test". This page signs locally, but treat any secret you type as exposed in your clipboard and shell history; use a throwaway dev secret like test-secret-123 instead.

• Forgetting exp is Unix seconds, not milliseconds. Writing {"exp":1735689600000} sets expiry to the year 56992 and your token never expires; drop the trailing 000 or use Math.floor(Date.now()/1000)+3600.

• Expecting the header alg to be auto-set. If you edit the header JSON to {"alg":"none"} but pick HS256 in the dropdown, the dropdown wins for signing while the header lies; keep alg in the header matching the algorithm you actually selected.

Privacy