🧰Locly

Encode and Sign JWT (HS256)

Encode and sign JWT tokens with HS256 in your browser

HS256 only. Your secret is processed locally in your browser and never uploaded. Do not use production secrets on shared devices.

About This Tool

JWT Encoder signs JSON Web Tokens with HS256 using the Web Crypto API entirely in your browser. Paste header and payload JSON, provide a secret, and get a compact JWT. Only HS256 is supported — no RS256 or private-key upload. Secrets never leave your device. Decode with Locly’s JWT Decoder to verify.

How to Use

  1. Edit header JSON (keep alg HS256)
  2. Edit payload JSON claims
  3. Enter your HMAC secret
  4. Click Encode & Sign
  5. Copy the token or verify it in JWT Decoder

Common Use Cases

  • Dev: Quickly mint HS256 tokens for local APIs
  • Debug: Reproduce tokens without posting secrets online
  • Learning: Understand JWT header.payload.signature structure
  • QA: Generate test tokens with known claims
  • Offline: Sign tokens when you cannot use a backend

FAQ

Q1: Which algorithms are supported?

Only HS256 (HMAC-SHA256). RS256 and private keys are not supported.

Q2: Does my secret leave the browser?

No. Signing is processed locally in your browser — nothing is uploaded.

Q3: How do I verify the token?

Paste it into Locly’s JWT Decoder (or jwt.io) with the same secret.

Q4: Why do I get a JSON error?

Header and payload must be valid JSON objects before signing.

Related Tools

JWT DecoderBase64SHA-256 & MD5 HashPassword Generator