即时解码和检查 JSON Web 令牌
Decoding JWT tokens is simple and instant:
usecases.intro
当API请求因认证错误失败时，解码JWT检查过期时间、颁发者和受众声明，以确定根本原因。
检查应用程序中使用的JWT，验证敏感数据是否未在负载中暴露，以及是否使用了适当的算法。
在开发过程中，快速验证生成的令牌是否包含正确的声明、角色和权限，然后再进行集成测试。
检查'exp'和'iat'声明以了解令牌有效期，并排查应用程序中的会话超时问题。
JWT新手学生和开发人员可以可视化三部分结构（头部、负载、签名），更好地理解基于令牌的认证工作原理。
JWT（JSON Web Token）是一种开放标准（RFC 7519），用于以JSON对象的形式在各方之间安全地传输信息。它紧凑、URL安全，广泛用于现代Web应用程序的认证和信息交换。
JWT由三个用点分隔的部分组成：头部（算法和令牌类型）、负载（声明和数据）和签名（验证哈希）。每个部分都经过Base64URL编码以确保安全传输。
JWT主要用于认证（登录会话）、授权（访问控制）和服务之间的安全信息交换。它们是无状态的，无需服务器端会话存储。
虽然JWT经过签名以防止篡改，但负载只是编码而非加密。切勿在JWT中存储密码等敏感数据。始终在服务器端验证签名，并使用HTTPS进行传输。
Decoding means extracting and reading the header and payload from the token using Base64Url decoding - anyone can do this. Verifying means checking the signature to ensure the token wasn't tampered with - this requires the secret key or public key. Our tool only decodes tokens; signature verification must be done on your secure server.
Our tool processes tokens entirely in your browser - nothing is sent to servers. However, you should still be cautious with production tokens. For maximum security, only use test/development tokens, or use this tool offline by saving the webpage locally.
All JWTs start with 'eyJ' because the header JSON (typically {"alg":"HS256","typ":"JWT"}) begins with '{"' which Base64Url encodes to 'eyJ'. This is a reliable indicator that a string is a JWT token.
No, signature verification requires the secret key (HMAC algorithms) or public key (RSA/ECDSA algorithms). Entering these keys into an online tool would be a serious security risk. Always verify signatures on your own secure servers using trusted libraries.
The 'exp' (expiration) claim is a Unix timestamp indicating when the token expires. Tokens should be rejected after this time. For example, 'exp': 1735689600 means the token expires on January 1, 2025 at 00:00:00 UTC.
Standard JWTs have exactly two dots separating three parts (header.payload.signature). Extra dots indicate the token may be malformed, double-encoded, or not a standard JWT. Check your token generation code.
Yes! OAuth 2.0 access tokens and ID tokens (from OpenID Connect) are often JWTs. You can decode them to view user information, scopes, expiration times, and other claims. However, some OAuth providers use opaque tokens (random strings) which cannot be decoded.
The 'none' algorithm means the token has no signature. If a server accepts tokens with 'alg': 'none', attackers can forge tokens by creating header/payload with any claims and no signature. Secure systems should always reject tokens with the 'none' algorithm.
Encode and decode Base64
Format and validate JSON data for easy reading
Decode JWT tokens
Generate MD5 hash (not recommended for security)
Generate SHA-256 hash (recommended for password storage)