What claims should I include in my JWT payload?

Always include "exp" (expiration) to limit token lifetime — a token without "exp" never expires, which is a security risk. Include "sub" (subject, typically a user ID), "iat" (issued at), and "aud" (audience) for complete validation. Add only the claims your application needs — avoid embedding sensitive data like passwords or financial information in the payload.

Why is my generated token different each time even with the same payload?

If your payload includes time-based claims like "iat" (issued at), the token will change each time you encode because the timestamp changes. If you use a static payload with no time-based claims, the token will be identical each time for the same secret.

How do I set a token expiration?

Set the "exp" claim to a Unix timestamp (seconds since epoch). For example, to expire in 1 hour: Math.floor(Date.now() / 1000) + 3600 in JavaScript, or int(time.time()) + 3600 in Python. Keep access token lifetimes short (15-60 minutes) and use refresh tokens for longer sessions.

Can I use this encoder for production token signing?

This tool is intended for development, debugging, and learning. For production, sign tokens in your backend application code where the secret is stored securely in environment variables — never sign tokens in client-side JavaScript where the secret could be exposed.

How do I create a JWT token?

Set the header alg to HS256, add claims like sub and exp in the payload, enter your secret, and sign. In production use a server-side library with algorithms pinned to HS256 and short expiration times.

Tool

JWT Encoder

Construct and sign JSON Web Tokens with custom headers and payloads. Signing uses HS256 via the Web Crypto API — client-side only.

Last updated July 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Header (JSON)

Payload (JSON)

Secret key

Signed JWT token

Click "Sign & encode JWT" to create a signed token.

Signed with HS256 using the Web Crypto API. Client-side only.

CLI equivalents (sign HS256)

node -e "console.log(require('jsonwebtoken').sign({sub:'123'}, process.env.JWT_SECRET, {algorithm:'HS256',expiresIn:'1h'}))"

Edit the header JSON to set your algorithm (HS256 is selected by default) and token type. The header is automatically base64url-encoded when the token is generated.

Edit the payload JSON to include your claims. Standard claims include "sub" (subject), "exp" (expiration as a Unix timestamp), "iat" (issued at), and "aud" (audience). Add any custom claims your application needs.

Enter your HS256 secret key and click "Encode" to generate a signed JWT. Copy the resulting token to use in your application or to test with the JWT Validator tool. Optional CLI snippets below show jsonwebtoken / jose / PyJWT sign equivalents.

const jwt = require('jsonwebtoken');

const payload = {
  sub: 'user_123',
  name: 'Jane Doe',
  role: 'admin',
  iat: Math.floor(Date.now() / 1000),
  exp: Math.floor(Date.now() / 1000) + 3600, // 1 hour
};

const secret = 'YOUR_SECRET_HERE';

const token = jwt.sign(payload, secret, { algorithm: 'HS256' });
console.log(token);

const jwt = require('jsonwebtoken');

const payload = {
  sub: 'user_123',
  name: 'Jane Doe',
  role: 'admin',
  iat: Math.floor(Date.now() / 1000),
  exp: Math.floor(Date.now() / 1000) + 3600, // 1 hour
};

const secret = 'YOUR_SECRET_HERE';

const token = jwt.sign(payload, secret, { algorithm: 'HS256' });
console.log(token);

import jwt
import time

payload = {
    'sub': 'user_123',
    'name': 'Jane Doe',
    'role': 'admin',
    'iat': int(time.time()),
    'exp': int(time.time()) + 3600,  # 1 hour
}

secret = 'YOUR_SECRET_HERE'

token = jwt.encode(payload, secret, algorithm='HS256')
print(token)

import (
    "github.com/golang-jwt/jwt/v4"
    "time"
)

claims := jwt.MapClaims{
    "sub":  "user_123",
    "name": "Jane Doe",
    "role": "admin",
    "iat":  time.Now().Unix(),
    "exp":  time.Now().Add(time.Hour).Unix(),
}

token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
secret := []byte("YOUR_SECRET_HERE")
tokenString, err := token.SignedString(secret)

How to Use This Tool

Continue learning