JSON 포맷터
JSON을 읽기 쉽게 정리합니다.
개발 도구
JWT 디코더
서명 검증 없이 헤더와 페이로드를 확인합니다.
JWT 디코더
UtilBrix 제공Decoding a JWT does not verify its signature or establish that it is valid. Treat all decoded claims as untrusted.
자세한 방법과 예시는 영어로 제공됩니다.
Step-by-step instructions (English)
- Paste the compact JWT into the token field.
- Decode and inspect the header, payload, and available timestamp claims.
- Check the issuer, audience, and expiration in your own authentication system before making any security decision.
공식 및 방법
Split the token into header, payload, and signature. Decode the first two sections using Base64URL and parse them as JSON. Numeric iat, exp, and nbf claims are displayed as dates. No secret, key, or signature verification is performed.
실용 예시
An exp claim of 0 refers to the Unix epoch. Displaying that claim does not prove the token came from a trusted issuer.
When this tool is useful
Inspect a token while debugging authentication or compare the claims emitted by development environments. Decoding helps explain what the token says, but does not establish who created it.
Common mistakes and limitations
- A readable payload and an unexpired exp claim do not prove a token is authentic.
- The tool does not have the issuer key and never verifies the signature; do not use its output as an authorization decision.
Practical questions about this tool (English)
Can this decode an encrypted JWT?
This tool inspects a three-part signed-token representation. Encrypted JWE tokens use a different structure and require decryption keys that this tool does not request.
Why are exp, iat, and nbf shown as dates?
Those claims use numeric epoch timestamps. Presenting them as dates makes debugging easier without changing whether the token is valid or trusted.