JWT Encoder
Create and sign JSON Web Tokens with custom payloads
JWT Encoder
Create and sign JSON Web Tokens with custom payloads
Use a strong secret key (at least 32 characters recommended)
Security Note
All JWT generation happens locally in your browser. Your secret key is never sent to any server. Never share your secret key or use it in client-side code. JWTs are signed, not encrypted—anyone can read the payload.
Perguntas frequentes
What algorithm should I use for JWT?
HS256 (HMAC-SHA256) is the most common for symmetric signing. For asymmetric encryption with public/private keys, use RS256. Choose based on your security requirements and key management capabilities.
How long should my JWT secret be?
Use at least 256 bits (32 characters) for HS256. Longer is better—generate a random string using a password generator. Never use predictable or short secrets in production.
Should I include sensitive data in JWT payloads?
No, JWTs are signed but not encrypted—anyone can decode and read the payload. Never include passwords, credit card numbers, or sensitive personal data. Use JWTs for identity claims only.