JSON-Formatierer
Formatieren Sie JSON übersichtlich und erleichtern Sie die Fehlersuche.
Entwickler-Tools
JWT-Dekodierer
Untersuchen Sie Token-Header und Nutzdaten lokal im Browser.
JWT-Dekodierer
Unterstützt von UtilBrixDecoding a JWT does not verify its signature or establish that it is valid. Treat all decoded claims as untrusted.
Detaillierte Methoden, Beispiele und einige erweiterte Hinweise sind derzeit auf Englisch verfügbar.
Step-by-step instructions (English)
- Paste the compact JWT into the token field.
- Decode and inspect the header, payload, and available timestamp claims.
- Check the issuer, audience, and expiration in your own authentication system before making any security decision.
Formel und Methode
Split the token into header, payload, and signature. Decode the first two sections using Base64URL and parse them as JSON. Numeric iat, exp, and nbf claims are displayed as dates. No secret, key, or signature verification is performed.
Ein praktisches Beispiel
An exp claim of 0 refers to the Unix epoch. Displaying that claim does not prove the token came from a trusted issuer.
When this tool is useful
Inspect a token while debugging authentication or compare the claims emitted by development environments. Decoding helps explain what the token says, but does not establish who created it.
Common mistakes and limitations
- A readable payload and an unexpired exp claim do not prove a token is authentic.
- The tool does not have the issuer key and never verifies the signature; do not use its output as an authorization decision.
Practical questions about this tool (English)
Can this decode an encrypted JWT?
This tool inspects a three-part signed-token representation. Encrypted JWE tokens use a different structure and require decryption keys that this tool does not request.
Why are exp, iat, and nbf shown as dates?
Those claims use numeric epoch timestamps. Presenting them as dates makes debugging easier without changing whether the token is valid or trusted.