JWT Encoder Online — Free & Private
Build and sign a JWT with a secret, using HS256. Free, private, and processed entirely in your browser — no upload, no account, no file ever leaves your device.
How to use JWT Encoder
Build and sign a JWT with a secret, using HS256. Everything runs in this tab — nothing is uploaded for the core job.
- Enter your content — Type or paste what you want to work with — JWT Encoder runs immediately in your browser.
- Choose your options — Set any options JWT Encoder offers.
- Get your result — Copy or download the result \u{2014} done entirely on your device, nothing uploaded.
Privacy proof for JWT Encoder
This tool processes files in your browser. Open DevTools → Network while you run it: your document is not uploaded. After one online visit, many tools keep working with Airplane Mode on (libraries cached locally).
Popular tools
The highest-demand tools with full options — browse by category below for the rest.
Star any tool — it appears under Favorites on this device.
How this actually works
Each tool runs entirely with JavaScript already loaded in this page — PDF tools via pdf-lib and pdf.js, image tools via the browser's native Canvas API, and everything else with plain JavaScript. Your files or input are read into browser memory, processed, and handed back as a download or copyable result. This page itself is served by a small Laravel route; Laravel never sees your files either. The only backend in use is Supabase, and only for two optional things: signing in with a magic link, and — only if you're signed in — a log of which tool you ran and when. Honest limits worth knowing: Compress PDF flattens each page to a re-encoded image (great for scans, not ideal if you need selectable text after); HEIC conversion uses a small on-demand converter when the browser cannot decode HEIC natively (Safari often works without it); Fill PDF Form is best-effort for simple AcroForm fields, not a full Adobe Forms replacement; and Word/Excel/PowerPoint ⇄ PDF genuinely needs a server-side engine, so it isn't included — this build only ships tools that can honestly run client-side.
Questions people actually ask
What algorithm does this sign with?
HS256 (HMAC using SHA-256) — the most common symmetric JWT signing algorithm, where the same secret both signs and verifies the token.
Why isn't RS256 (asymmetric) offered?
RS256 needs a real private/public RSA key pair, which is a meaningfully bigger, riskier thing to generate and paste into a browser tool than a shared secret — HS256 covers the common "test/debug a token" case this tool is built for.
Is this safe to use with a real production secret?
Signing happens entirely in your browser and the secret is never transmitted, but treat any real production secret as sensitive regardless — prefer a test/throwaway secret when you can.
Does it validate my header and payload JSON?
Yes — both need to be valid JSON before signing; you'll get a clear error if either isn't.
Can I decode the JWT this produces?
Yes — paste it into this site's JWT Decoder to inspect the header and payload, or back into the algorithm field here to verify by re-signing and comparing.
What claims should I include in the payload?
Whatever your use case needs — common ones are "sub" (subject/user ID), "iat" (issued-at timestamp), and "exp" (expiry timestamp), but the payload is just arbitrary JSON, not a fixed schema.
Does it set "iat" or "exp" automatically?
No — the payload is used exactly as you type it; add any timestamp claims yourself if you need them (the Unix Timestamp Converter can help compute the right value).
Is my secret sent anywhere?
No — signing uses the Web Crypto API entirely in your browser; the secret, header, and payload are never transmitted.
Is this really free, and is there a file size limit?
Yes — no account, no paywall. Since processing happens in your browser's memory rather than uploading anywhere, the practical limit is your device's available RAM, not a server quota. Very large files (500+ pages) may run slower, especially for Compress and PDF→JPG.
Does anything about my file get sent anywhere?
No. Every tool runs with pdf-lib/pdf.js loaded in this page; your file is read into browser memory and never leaves it. The only network call this app makes for your account is Supabase auth — and that only stores which tool you ran and when, never file content.
Why isn't Word/Excel/PowerPoint → PDF included?
Converting Office formats accurately needs a real rendering engine (what Word or LibreOffice use internally) — no browser library does this reliably. Rather than ship a broken version, it's left out.
Does TechDriven Tools have OCR (text recognition)?
Yes — OCR PDF recognizes text in scanned or photographed pages using Tesseract.js, running entirely on your device, and gives you a searchable PDF or a plain text file. Nothing is uploaded for this either.
Can I use this without an internet connection?
Once the page and its libraries have loaded once, yes — the tools themselves need no network access. Signing in and viewing history do require a connection, since those talk to Supabase.
What happens to the "history" if I sign in?
Only a row per tool run — the tool's name and a timestamp. No filename, no file content, ever. You can see the full list any time via the History button.
Are the non-PDF utilities (password generator, JSON formatter, etc.) private too?
Yes — same rule as the PDF tools. Word Counter, Case Converter, Password Generator, UUID Generator, Base64, Hash Generator, JSON Formatter and JWT Decoder all run with plain JavaScript already loaded in this page; nothing you type or paste is sent anywhere.
JWT Encoder, in depth
Build and sign a JWT with a secret, using HS256 — real HMAC signing via the Web Crypto API.
Features
Custom Claims
Edit the header and payload JSON directly.
Real HMAC-SHA256
A genuine signature via the browser's Web Crypto API, not a fake placeholder.
Instant
No network call — signing happens locally.
Copyable Output
Get the full token, ready to use for testing.
Why use JWT Encoder
- Build a test token for an API that expects JWT authentication.
- Understand how a JWT is actually assembled by constructing one yourself.
- Test how your code handles a specific set of claims or an expired token.
- Generate a token for local development without a real auth server running.
How it works
The header and payload are Base64URL-encoded, joined with a dot, and signed using HMAC-SHA256 via crypto.subtle.sign() — a genuine cryptographic signature computed with your secret, not a placeholder string. The secret you enter is used only in your browser and never transmitted anywhere.
A note on where to use generated tokens
A token signed here is only valid for a system that shares the same secret — this is meant for testing your own systems, not for interacting with a service whose secret you don't control. For inspecting a token someone else issued, use JWT Decoder instead, which doesn't require a secret at all.
Why people search for JWT Encoder
Build and sign a JWT with a secret, using HS256. Bookmark /jwt-encoder if JWT Encoder is part of your weekly workflow; the URL is stable and the tool stays free.
JWT Encoder sits in our Developer Tools group. The page is built so you can finish the job without creating an account, installing a desktop pack, or sending the payload to an unknown converter API.
Who JWT Encoder is for
- A desktop suite is overkill for a one-page or one-photo job.
- You want a second opinion after another converter produced a weird output.
- You need a result now and do not want another account wall.
- The file or text is sensitive enough that uploading feels wrong.
Recommended workflow
Paste only what you intend to transform → run locally → copy into your editor or terminal → never paste production secrets into random upload sites.
- Open JWT Encoder (also available from category hubs and ⌘K).
- Use the labeled fields or dropzone — options match what JWT Encoder actually does.
- Run the tool and wait for local progress to finish.
- Download or copy the result, then verify on the device where you will share it.
Tips that improve results
- Keep the original until stakeholders accept the download.
- Rename the output with date + purpose before you attach it to email.
- On phones, plug in power for large PDFs, videos, or spreadsheets.
- Prefer UTF-8 text for developer converters; weird encodings cause most “broken” results.
- Start with a non-sensitive sample so you learn the options before the real file.
- Change one setting at a time when you are comparing quality or layout.
Common mistakes with JWT Encoder
- Expecting JWT Encoder to replace a full desktop suite for every edge-case format.
- Skipping a sample check and discovering a bad export after the original was deleted.
- Chaining many lossy image/PDF steps when one careful pass would have been enough.
- Using a public computer without clearing downloads afterward.
Privacy model
Processing for JWT Encoder is designed to stay in the browser. Laravel serves the page; it does not receive your file bytes for conversion. Optional Supabase auth only stores which tool you ran and when — never filenames or contents.
Related tools
- Password Generator
- Base64 Encoder/Decoder
- Hash Generator
- JSON Formatter
- JWT Decoder
- QR Code Generator
FAQ — JWT Encoder
Is JWT Encoder free to use?
Yes. JWT Encoder on TechDriven Tools is free — no account, no watermark, and no paywall for the core workflow.
Does JWT Encoder upload my file or text?
No for processing. JWT Encoder runs in your browser tab. Optional sign-in never stores file contents — only tool names and timestamps if you enable history.
When should I use JWT Encoder?
Use JWT Encoder for Developer Tools jobs where privacy and speed matter: quick one-offs, sensitive inputs, or checking another app’s result without another upload site.
Will JWT Encoder work on my phone?
Yes in a modern mobile browser. Large inputs can take longer because your device does the work locally.
What are the limits of JWT Encoder?
There is no server quota from us. Limits are your device memory, battery, and formats the browser can decode. JWT Encoder will not pretend to support server-only Office or cloud-AI pipelines.
How is JWT Encoder different from upload-based sites?
Upload converters send your content to someone else’s server. JWT Encoder keeps the transform on-device whenever the format allows, which is the safer default for confidential documents, photos, tokens, and configs.
Bottom line
If you need JWT Encoder done quickly and privately, start at /jwt-encoder, run it once on a sample, then process the real input. That is how TechDriven Tools stays competitive: honest capabilities, labeled UI, and content that matches what the tool actually ships.
From our blog: How to Create and Sign a JWT (HS256)