Formattatore JSON
Formatta JSON per renderlo leggibile.
Sviluppo
Decodificatore JWT
Esamina intestazioni e dati senza verificare la firma.
Decodificatore JWT
Offerto da UtilBrixDecoding a JWT does not verify its signature or establish that it is valid. Treat all decoded claims as untrusted.
I metodi dettagliati e gli esempi sono disponibili in inglese.
Step-by-step instructions (English)
- Paste the compact JWT into the token field.
- Decode and inspect the header, payload, and available timestamp claims.
- Check the issuer, audience, and expiration in your own authentication system before making any security decision.
Formula e metodo
Split the token into header, payload, and signature. Decode the first two sections using Base64URL and parse them as JSON. Numeric iat, exp, and nbf claims are displayed as dates. No secret, key, or signature verification is performed.
Esempio pratico
An exp claim of 0 refers to the Unix epoch. Displaying that claim does not prove the token came from a trusted issuer.
When this tool is useful
Inspect a token while debugging authentication or compare the claims emitted by development environments. Decoding helps explain what the token says, but does not establish who created it.
Common mistakes and limitations
- A readable payload and an unexpired exp claim do not prove a token is authentic.
- The tool does not have the issuer key and never verifies the signature; do not use its output as an authorization decision.
Practical questions about this tool (English)
Can this decode an encrypted JWT?
This tool inspects a three-part signed-token representation. Encrypted JWE tokens use a different structure and require decryption keys that this tool does not request.
Why are exp, iat, and nbf shown as dates?
Those claims use numeric epoch timestamps. Presenting them as dates makes debugging easier without changing whether the token is valid or trusted.