diff --git a/spec/jwt_spec.lua b/spec/jwt_spec.lua
index 9b18f99..66dfea3 100644
--- a/spec/jwt_spec.lua
+++ b/spec/jwt_spec.lua
@@ -199,7 +199,7 @@ D5z2A7KPYXUgUP0jd5yLZ7+pVBcFSUm5AZXJLXH4jPVOXztcmiu4ta0CAwEAAQ==
     assert.are.same(claims, decodedClaims)
   end)
 
-    it("does not throw an error when key is invalid in rs256", function()
+  it("does not throw an error when key is invalid in rs256", function()
     local keys = {
       private =
 [[-----BEGIN RSA PRIVATE KEY-----
@@ -240,4 +240,19 @@ D5z2A7KPYXUgUP0jd5yLZ7+pVBcFSUm5AZXJLXH4jPVOXztcmiu4ta0CAwEAAQ==
       assert.is_not_nil(err)
     end)
   end)
+
+  it("should decode token generated by jwt.io", function()
+    local secret = "38i2UHVo61az0Wr2ExOw0E3O301fer0X"
+    local token  = "eyJhbGciOiJIUzI1NiJ9.eyJ0ZXN0IjoidmFsdWUiLCJhcnJheSI6WzEsMiwzXX0.fL5OGpjWwf0VFsFfcB9zSjU8wfbKt-hUIOD8kqTvlAw"
+    local data   = {test="value", array = {1, 2, 3}}
+    assert.same(data, jwt.decode(token, {keys = {public = secret}}))
+  end)
+
+  it("should generate same token as jwt.io", function()
+    local secret = "38i2UHVo61az0Wr2ExOw0E3O301fer0X"
+    local token  = "eyJhbGciOiJIUzI1NiJ9.eyJ0ZXN0IjoidmFsdWUiLCJhcnJheSI6WzEsMiwzXX0.fL5OGpjWwf0VFsFfcB9zSjU8wfbKt-hUIOD8kqTvlAw"
+    local data   = {test="value", array = {1, 2, 3}}
+    assert.equal(token, jwt.encode(data, {alg = "HS256", keys = {private = secret}}))
+  end)
+
 end)
diff --git a/src/jwt/jws.lua b/src/jwt/jws.lua
index fddfe12..3ae4a4d 100644
--- a/src/jwt/jws.lua
+++ b/src/jwt/jws.lua
@@ -6,6 +6,8 @@ local json   = utils.json
 local HMAC   = utils.HMAC
 local DIGEST = utils.DIGEST
 
+local ENCODE_AS_HEX = false
+
 local data    = {}
 
 local function tohex(s)
@@ -17,9 +19,9 @@ local function tohex(s)
 end
 
 data.sign = {
-  ['HS256'] = function(data, key) return HMAC.SHA256(key, data, true) end,
-  ['HS384'] = function(data, key) return HMAC.SHA384(key, data, true) end,
-  ['HS512'] = function(data, key) return HMAC.SHA512(key, data, true) end,
+  ['HS256'] = function(data, key) return HMAC.SHA256(key, data, ENCODE_AS_HEX) end,
+  ['HS384'] = function(data, key) return HMAC.SHA384(key, data, ENCODE_AS_HEX) end,
+  ['HS512'] = function(data, key) return HMAC.SHA512(key, data, ENCODE_AS_HEX) end,
   ['RS256'] = function(data, key)
     assert(type(key) == "string")
     local ok, result = pcall(function()
@@ -31,9 +33,9 @@ data.sign = {
 }
 
 data.verify = {
-  ['HS256'] = function(data, signature, key) return signature == HMAC.SHA256(key, data, true) end,
-  ['HS384'] = function(data, signature, key) return signature == HMAC.SHA384(key, data, true) end,
-  ['HS512'] = function(data, signature, key) return signature == HMAC.SHA512(key, data, true) end,
+  ['HS256'] = function(data, signature, key) return signature == HMAC.SHA256(key, data, ENCODE_AS_HEX) end,
+  ['HS384'] = function(data, signature, key) return signature == HMAC.SHA384(key, data, ENCODE_AS_HEX) end,
+  ['HS512'] = function(data, signature, key) return signature == HMAC.SHA512(key, data, ENCODE_AS_HEX) end,
   ['RS256'] = function(data, signature, key)
     assert(type(key) == "string")
     local ok, result = pcall(function()