Question 1

What algorithm does this JWT encoder use?

Accepted Answer

HS256 only: HMAC-SHA-256 via the Web Crypto API. The header defaults to alg HS256 and typ JWT. Other algorithms are not signed on this page.

Question 2

Does the secret leave my browser?

Accepted Answer

No. Header, payload, and secret stay on this device. ToolPetal has no backend for JWT encoding.

Question 3

How do I set an exp claim?

Accepted Answer

Tick Set exp and choose minutes, hours, or days. The encoder writes a Unix timestamp onto the payload (and iat if you leave that box checked) before signing.

Question 4

Is this a JWT decoder?

Accepted Answer

No. The primary tool encodes a compact JWT. A small decode panel shows the header and payload of the token you just built so you can confirm claims. It is not a general jwt.io-style debugger.