JWT Decoder

Sobre esta ferramenta

A JSON Web Token is three base64url encoded parts joined by dots, a header, a payload and a signature. The header and payload are themselves JSON once decoded, so this page decodes each with the same base64url decoder the JSON to Base64 tool already uses, URL safe alphabet and missing padding both handled, and reports which of the two failed if either does not decode cleanly or does not turn out to be a JSON object. The signature is shown exactly as written and never decoded further, since it is cryptographic output rather than text and there is nothing readable inside it to show. Seven registered claims from the payload get their own row when the token carries them: issuer, subject, audience, issued-at, not-before, expiry and a JWT ID, with the three time based ones read as the dates they actually are rather than left as raw numbers. A token whose expiry has passed, or whose not-before time has not arrived yet, is marked as such plainly rather than left for you to work out from the raw numbers yourself. What this page does not do, on purpose, is check the signature against anything: doing that honestly needs the actual secret or public key the token was signed with, which this page never asks for, and a decoder that implied trust it could not back up would be worse than one that says nothing. A token can be perfectly well formed, decode cleanly here, and still be forged or altered, and only real signature verification, a separate tool, can tell the difference.

Como usar

1. 1 Paste a JSON Web Token. It is the three dot separated parts most APIs hand you as a single string.
2. 2 The header, the payload and the standard claims decode as you type. Nothing here is sent anywhere; it all happens in your browser.
3. 3 Check the Claims panel for an expired or not-yet-valid warning, and remember: this decodes the token, it does not verify it.