JWT Encoder

Sign a JSON Web Token with HMAC — edit the header and the claims, pick HS256, HS384 or HS512.

A JSON object naming the algorithm. It's signed as it stands, with the "alg" of the algorithm chosen below.

The claims to sign, as a JSON object. The registered ones — iss, sub, aud, iat, nbf, exp — are explained below.

The secret never leaves your browser: the signature is worked out here, in the page, and nothing is sent anywhere. In real use a server signs the token and keeps the secret, because anyone who holds it can make tokens that pass for yours.

Algorithm

A life stamps iat from your clock and exp that far ahead. The payload keeps any iat it already carries.

The token

ewogICJhbGciOiAiSFMyNTYiLAogICJ0eXAiOiAiSldUIgp9.ewogICJpc3MiOiAiaHR0cHM6Ly9xdWFja3lhcmQuY29tIiwKICAic3ViIjogInVzZXJfMTIzNDUiLAogICJuYW1lIjogIkFkYSBMb3ZlbGFjZSIKfQ.Y_E9Mt8VjyxwbydOqgcsiC6xNe6YWRMP0L39nsjFJXg

headerpayloadsignature

19 bytes of secret, signed as HS256. HMAC with SHA: one shared secret makes the signature and checks it, so anyone who can check this token can also forge it.

Claims
ClaimIn this token
iss

Issuer is who created the token, usually a URL or a domain name

https://quackyard.com
sub

Subject is who the token is about, usually a user id

user_12345

More in the yard