JWT: Verify Signature Secret Format.

Question

I am trying to create a JWT. I am following the format provided here: https://jwt.io/

Under VERIFY SIGNATURE there is a property called secret

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret    
) 

How do I create that secret in code? Can it be any string or it has to be a certain format?

Answer 1

The secret can be anything: when it is a string you can paste it verbatim in the "secret" entry, when it is a binary secret (a sequence of bytes) you should first base64-encode it, paste it in the "secret" box and tick the "secret base64 encoded" button.

Note that jwt.io can verify an existing JWT against a provided key, it cannot generate JWTs and sign them.