What can I sign with?

HS256 (symmetric, fast — same secret for sign and verify) or RS256 (asymmetric — private key signs, public key verifies). Pick based on who needs to verify.

Cross-service verification — the issuer has the private key, consumers only need the public key. Can't forge tokens without the private key.

What claims are required?

None are required by spec, but `exp` (expiration) is strongly recommended to limit damage if a token leaks. Toggle to include common claims.

JWT Encoder | DevTools Surf

DevTools Surf

Example: JWT Encoder

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

{"sub":"1234567890","name":"John Doe","iat":1516239022}
my-secret-key
HS256

Output

Algorithm: HS256
Header:    {"alg":"HS256","typ":"JWT"}
Payload:   {"sub":"1234567890","name":"John Doe","iat":1516239022}
Size:      155 bytes (header 36 / payload 74 / signature 43)

Token:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.MRvO3fE0o9C-pZfd3pI0hMDDXihJfQa1XPQ-UAelzaI

Warnings:
  - Secret is 13 bytes. RFC 7518 requires at least 32 bytes for HS256.
  - No exp claim — this token never expires.

About JWT Encoder

JWT Encoder preview - Security / Crypto tool

Encode a JWT token from header, payload, and secret. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Creating test JWTs for local API development and debugging
Generating mock auth tokens for integration test suites
Encoding custom claims for JWT-based feature flag systems
Building sample tokens for API documentation examples

Tips

Set the algorithm and secret to generate a signed JWT
Include standard claims like exp, iat, and sub in the payload
Test your encoding against the expected token format

Fun Facts

JWT (RFC 7519) was authored by Michael Jones, John Bradley, and Nat Sakimura and published in May 2015.
JWTs are not encrypted by default; the payload is merely Base64URL-encoded, so sensitive data should never be stored without JWE.
The jwt.io debugger, maintained by Auth0, receives over 3 million monthly visits, making it the most popular JWT tool on the web.

FAQ

What can I sign with?: HS256 (symmetric, fast — same secret for sign and verify) or RS256 (asymmetric — private key signs, public key verifies). Pick based on who needs to verify.
When to use RS256?: Cross-service verification — the issuer has the private key, consumers only need the public key. Can't forge tokens without the private key.
What claims are required?: None are required by spec, but `exp` (expiration) is strongly recommended to limit damage if a token leaks. Toggle to include common claims.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder OAuth PKCE Generator