About the JWT Encoder
A JSON Web Token is three Base64URL-encoded segments joined by dots: a header naming the algorithm, a payload of claims, and a signature over the first two. The critical property, and the one most often misunderstood, is that the payload is encoded rather than encrypted. Anyone holding the token can read every claim in it without any key at all.
This encoder builds and signs a token in your browser so you can see exactly how a change to the header or claims changes the output. Because signing happens locally, the secret you type is never transmitted — but for the same reason, tokens built here are for development and testing, not for minting production credentials.
The signature proves that the token was issued by someone holding the key and has not been altered since. It proves nothing about whether the token is still valid, so a verifier must check expiry, audience, and issuer separately.
Frequently asked questions
Is data in a JWT encrypted?
No. The header and payload are Base64URL-encoded, which is reversible by anyone with no key whatsoever. Never put anything confidential in a JWT payload — no passwords, no personal data beyond what the client is already entitled to see, no internal identifiers you would not print in a log. If you genuinely need confidentiality, that is JWE, which is a different specification.
HS256 or RS256 — which should I use?
HS256 is symmetric, so the same secret both signs and verifies. That is fine when one service does both. RS256 is asymmetric: the issuer signs with a private key and any number of services verify with the public key. Once more than one service needs to verify tokens, RS256 is the right answer, because otherwise every verifier holds a key that also lets it mint tokens.
What is the alg none attack?
An attacker takes a valid token, edits the claims, sets the header algorithm to none, and strips the signature. A verifier that trusts the algorithm named in the token accepts it. The fix is to never let the token choose: pin the expected algorithm in the verifier configuration and reject anything else. A related attack switches RS256 to HS256 so that the public key gets used as an HMAC secret.
What do exp, iat, and nbf mean?
They are all numeric timestamps in seconds since the Unix epoch, not milliseconds — a very common bug that produces tokens valid for fifty thousand years. exp is when the token stops being valid, iat is when it was issued, and nbf is the earliest moment it may be accepted. Verifiers usually allow a small clock-skew tolerance of around a minute.
How do I revoke a JWT?
You cannot, in the general case, and that is the central trade-off of the format. A signed token stays valid until it expires because verification is stateless by design. The practical answers are short expiry times paired with refresh tokens, or a denylist of revoked token identifiers — but a denylist reintroduces the shared state that stateless tokens were adopted to avoid.
Need this managed for you, not just automated?
We're also a hands-on DevOps consultancy — Kubernetes, CI/CD, and cloud infrastructure.