jwt-encode
Create and sign JSON Web Tokens (JWTs) for testing and development. Use when the user wants to generate, create, build, or sign a JWT — e.g. "create a JWT", "generate a test token", "sign this payload", "make a JWT with these claims", "build an access token". Supports HMAC, RSA, and ECDSA algorithms
By jsonwebtoken · 510 installs
npx skills add jsonwebtoken/jwt-skills --skill jwt-encode
Source repository · Upstream listing
JWT Encode
Create and sign JWTs for testing and development.
Steps
1. Gather inputs : claims/payload, algorithm (default: HS256), secret or key, expiration (default: 1 hour).
2. Build header : {"alg": "HS256", "typ": "JWT"} . Add kid if provided.
3. Build payload : Always include iat and exp unless the user opts out. Add user specified claims.
4. Sign the token using the best available method (see below).
5. Display the result : the full JWT string and a decoded breakdown of header + payload.
Signing Methods
Pick the first available. Use the user's claims, secret, and algorithm — the examples below are templates only. Always pass the secret via an inline env var to avoid shell history exposure.
Node.js (preferred):
First, ensure jose is available — install it globally if missing:
Then sign the token:
Python :
Bash (HMAC SHA256 only):
Generating Test Keys
Only when the user needs asymmetric keys:
Security Rules
Never pass secrets as literal command line arguments. Use environment variables ( $JWT SECRET ) or file input ( secret file ). Command args are visible in shell history and ps output.
Never install packages without user consent. Do not use npx y or pip install silently.
If the user doesn't provide a secret , generate a random one with openssl rand base64 32 and clearly label it as a test only secret.
alg: none — If the user requests it, warn that this creates an unsigned token exploitable via CVE 2015 9235. Only create it after explicit confirmation.
Generated key files — Remind the user to delete test keys when done. Never write keys to version controlled directories.