JWT signature not verifying in PHP
<p>I'm just getting started with token-based authentication and have written a very simple PHP script to create a JWT. However, when I run it in jwt.io's debugger, the signature never verifies. </p>

<p><a href="https://jwt.io/" rel="nofollow" title="JWT.io">JWT.io</a></p>

<pre><code>    $secret = "super_secure_private_key";

    function base64url_encode($data) {
        return rtrim(strtr(base64_encode($data), "+/", "-_"), "=");
    }

    $header = base64url_encode(json_encode([
        "alg" =&gt; "HS256",
        "typ" =&gt; "JWT"
    ]));

    $payload = base64url_encode(json_encode([
        "name" =&gt; "James Walker",
        "privileges" =&gt; "total"
    ]));

    $signature = base64url_encode(hash_hmac("sha256", $header . "." . $payload, $secret));

    $token = $header . "." . $payload . "." . $signature;
</code></pre>

<p>As far as I can tell, my implementation is inline with the formatting of JWT. Have I missed something, or should I use a library e.g. php-jwt to generate new tokens and get them verified?</p>

<p>For my use, my implementation would probably work alright anyway, since I can still verify the tokens myself using the same code. But I'm just not sure why jwt.io isn't verifying the signature.</p>