Formateur JSON
Formatez le JSON pour le rendre lisible.
Développement
Décodeur JWT
Inspectez les en-têtes et données sans vérifier la signature.
Décodeur JWT
Propulsé par UtilBrixDecoding a JWT does not verify its signature or establish that it is valid. Treat all decoded claims as untrusted.
Les méthodes détaillées et les exemples sont disponibles en anglais.
Step-by-step instructions (English)
- Paste the compact JWT into the token field.
- Decode and inspect the header, payload, and available timestamp claims.
- Check the issuer, audience, and expiration in your own authentication system before making any security decision.
Formule et méthode
Split the token into header, payload, and signature. Decode the first two sections using Base64URL and parse them as JSON. Numeric iat, exp, and nbf claims are displayed as dates. No secret, key, or signature verification is performed.
Exemple pratique
An exp claim of 0 refers to the Unix epoch. Displaying that claim does not prove the token came from a trusted issuer.
When this tool is useful
Inspect a token while debugging authentication or compare the claims emitted by development environments. Decoding helps explain what the token says, but does not establish who created it.
Common mistakes and limitations
- A readable payload and an unexpired exp claim do not prove a token is authentic.
- The tool does not have the issuer key and never verifies the signature; do not use its output as an authorization decision.
Practical questions about this tool (English)
Can this decode an encrypted JWT?
This tool inspects a three-part signed-token representation. Encrypted JWE tokens use a different structure and require decryption keys that this tool does not request.
Why are exp, iat, and nbf shown as dates?
Those claims use numeric epoch timestamps. Presenting them as dates makes debugging easier without changing whether the token is valid or trusted.