← All Tools
JWT Encode Converter🔒 100% local
Encode JWT tokens. Privacy-first, no server uploads, no tracking.
Takes a one-line instruction, secret first, then your payload JSON, separated by a pipe, and returns the complete HS256 token with each base64url part spelled out underneath. Pipe three fields instead of two and the middle one is used as the header verbatim, which is how you get a header other than the default alg and typ pair. The HMAC is computed in the page with the same pure-JavaScript SHA-256 the other JWT tools use.
How to use it
- Type or paste secret|payloadJSON, for example my-secret|{"sub":"123"}.
- Use three fields only when you need a custom header: secret|headerJSON|payloadJSON.
- Press Process and copy the token line, or one of the individual parts listed below it.
Worked example
my-secret|{"sub":"1234567890","name":"John Doe","iat":1700000000}becomes=== HS256 JWT ===
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNzAwMDAwMDAwfQ.va_xhw_fOvlbUAhSCOZ0X_YzTV570qiYxLQzyCzm04w
Parts:
Header: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 → {"alg":"HS256","typ":"JWT"}
Payload: eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNzAwMDAwMDAwfQ
Sig: va_xhw_fOvlbUAhSCOZ0X_YzTV570qiYxLQzyCzm04w
Note: JWTs are NOT encrypted - base64 only. Never put secrets in the payload.iat is in the payload here to keep the signature stable. Leave it out and the encoder stamps the current second, so the token changes on every press of Process.
When to use it
- Reproducing a token byte for byte so a test suite stops re-signing and re-failing on timestamps alone.
- Building a deliberately wrong token, such as one with a mismatched secret, to confirm your API rejects it.
- Walking a reviewer through a token while the header, payload and signature sit on separate lines next to it.
What it does not do
- HS256 is the only signature produced. Setting alg to RS256 in the custom header yields a token whose header lies about its own algorithm, because the third part is still a symmetric HMAC over the string you typed.
- The secret is whatever precedes the first pipe, so signing here is only as safe as that string. Fine for local testing, unsuitable for issuing sessions to real users.
- The payload is encoded, not encrypted: anyone holding the token can read every claim, so keep passwords, keys and personal data out of it.
- A secret that itself contains a pipe shifts the fields apart - the tool then tries to parse part of the secret as a header and fails with a header JSON error.