即時解碼和檢查 JSON Web 令牌
Decoding JWT tokens is simple and instant:
usecases.intro
當API請求因認證錯誤失敗時，解碼JWT檢查過期時間、簽發者和受眾聲明，以確定根本原因。
檢查應用程式中使用的JWT，驗證敏感資料是否未在負載中暴露，以及是否使用了適當的演算法。
在開發過程中，快速驗證產生的權杖是否包含正確的聲明、角色和權限，然後再進行整合測試。
檢查'exp'和'iat'聲明以了解權杖有效期，並排查應用程式中的工作階段逾時問題。
JWT新手學生和開發人員可以視覺化三部分結構（標頭、負載、簽名），更好地理解基於權杖的認證運作原理。
JWT（JSON Web Token）是一種開放標準（RFC 7519），用於以JSON物件的形式在各方之間安全地傳輸資訊。它緊湊、URL安全，廣泛用於現代Web應用程式的認證和資訊交換。
JWT由三個用點分隔的部分組成：標頭（演算法和權杖類型）、負載（聲明和資料）和簽名（驗證雜湊）。每個部分都經過Base64URL編碼以確保安全傳輸。
JWT主要用於認證（登入工作階段）、授權（存取控制）和服務之間的安全資訊交換。它們是無狀態的，無需伺服器端工作階段儲存。
雖然JWT經過簽名以防止竄改，但負載只是編碼而非加密。切勿在JWT中儲存密碼等敏感資料。始終在伺服器端驗證簽名，並使用HTTPS進行傳輸。
Decoding means extracting and reading the header and payload from the token using Base64Url decoding - anyone can do this. Verifying means checking the signature to ensure the token wasn't tampered with - this requires the secret key or public key. Our tool only decodes tokens; signature verification must be done on your secure server.
Our tool processes tokens entirely in your browser - nothing is sent to servers. However, you should still be cautious with production tokens. For maximum security, only use test/development tokens, or use this tool offline by saving the webpage locally.
All JWTs start with 'eyJ' because the header JSON (typically {"alg":"HS256","typ":"JWT"}) begins with '{"' which Base64Url encodes to 'eyJ'. This is a reliable indicator that a string is a JWT token.
No, signature verification requires the secret key (HMAC algorithms) or public key (RSA/ECDSA algorithms). Entering these keys into an online tool would be a serious security risk. Always verify signatures on your own secure servers using trusted libraries.
The 'exp' (expiration) claim is a Unix timestamp indicating when the token expires. Tokens should be rejected after this time. For example, 'exp': 1735689600 means the token expires on January 1, 2025 at 00:00:00 UTC.
Standard JWTs have exactly two dots separating three parts (header.payload.signature). Extra dots indicate the token may be malformed, double-encoded, or not a standard JWT. Check your token generation code.
Yes! OAuth 2.0 access tokens and ID tokens (from OpenID Connect) are often JWTs. You can decode them to view user information, scopes, expiration times, and other claims. However, some OAuth providers use opaque tokens (random strings) which cannot be decoded.
The 'none' algorithm means the token has no signature. If a server accepts tokens with 'alg': 'none', attackers can forge tokens by creating header/payload with any claims and no signature. Secure systems should always reject tokens with the 'none' algorithm.
Encode and decode Base64
Format and validate JSON data for easy reading
Decode JWT tokens
Generate MD5 hash (not recommended for security)
Generate SHA-256 hash (recommended for password storage)