JWT Encode Online — HS256, RS256, ES256 & More

Sign compact JWTs from header and payload JSON that you can edit. It supports none, HMAC, RSA, RSA-PSS, ECDSA, and EdDSA, with live debugging in the style of jwt.io. The algorithms come as HS, RS, PS, and ES variants at 256, 384, or 512 bits, plus Ed25519. Pair it with JWT Decode to inspect the result.

Loading…
JWT encoder with several signing algorithms
Sign compact JWTs from header and payload JSON that you can edit. It supports none, HMAC, RSA, RSA-PSS, ECDSA, and EdDSA (Ed25519), with a live debugger in the style of jwt.io. It does not replace production authentication.

How JWT encode works

Edit the header, payload, and signing material, and the encoded JWT updates automatically (debounced). The editors start empty, so use **Load sample** or pick an algorithm to load a demo fixture. Choose the algorithm from the toolbar or edit alg in the header JSON. iat is always set to now on encode. Use the Expiration dropdown to set exp (15m, 1h, 24h), or leave None to keep or omit exp in the payload JSON. HMAC uses a secret (optional base64url). RSA, RSA-PSS, ECDSA, and EdDSA use a PEM or JWK private key. alg=none produces an unsecured token. Encoding is not verification, so use jwt-decode to inspect.

Options

Expiration
A shortcut for the exp claim. None leaves your payload as it is, or without exp. 15m, 1h, and 24h set exp relative to the iat, which is refreshed on each encode, and they overwrite any exp already in the JSON.

Examples

Basic claims

Claims

{ "sub": "1234567890", "name": "Jane Doe", "role": "qa", "scope": "orders:read orders:write inventory:read", "iss": "fastminify-local-fixture", "aud": "fastminify-devtools", "note": "Local HS256 fixture claims only — not production auth" }

Result

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.… (HS256 compact JWT)

Inspect after encode

Claims

Encode then paste into jwt-decode

Result

Header shows HS256; payload shows iat/exp claims

Related tools

Inspect tokens with jwt-decode. Review a JWKS locally with inspect-jwks. Encoding here does not replace a verified authentication flow.

JWT encode FAQ

Multiple algorithms (the jwt.io set)

Does this verify JWTs?

No. It signs tokens locally. Use jwt-decode to inspect and verify signatures inline, or jwt-verify for JWKS and claim policies.

Which algorithms are supported?

none, HS256/384/512, RS256/384/512, PS256/384/512, ES256/384/512, and EdDSA (Ed25519 only). Remote JWKS and full exp/aud/iss validation stay on jwt-verify.

Is this a secure JWT for production?

No. This is a local helper for fixtures and debugging. It makes no claim that tokens are “secure” or that it replaces production authentication.

Encoding

Encode or decode Base64, URLs, HTML entities and JWTs, and generate hashes and HMACs in your browser.

Explore other tool categories