JWT编码器解码器
在浏览器中处理或呈现JWT编码器解码。
使用步骤
如何使用
- Paste a compact JWT with three dot-separated segments.
- Decode the header and payload locally.
- Review the signature segment and algorithm metadata without treating the token as verified.
What a compact JWT contains
A compact JSON Web Token has three Base64URL segments: a header, a payload, and a signature. This tool decodes the first two segments and shows useful facts about the third.
Decoding is not verification
Anyone can read a JWT payload. A decoded token may be expired, altered, or untrusted. This page does not check a key, validate claims, verify a signature, or make a token.
Local and ephemeral
Parsing happens entirely in your browser. The token is not uploaded or stored by this tool; avoid pasting live credentials into shared or recorded screens.
常见问题
你可能还想知道
Does this verify the JWT signature?
No. It only decodes the header and payload and reports opaque signature metadata. Use your application’s trusted verification code before accepting a token.
Can I decode an encrypted JWT?
No. Encrypted JWTs (JWE) use a different five-segment compact form and require the correct decryption key. This tool expects a three-segment signed JWT.
Does decoding prove the token is safe?
No. Decoding is for inspection only. Check issuer, audience, expiry, signature, and application-specific claims with trusted server-side logic.
Does my token leave the browser?
No. The page performs its parsing locally and does not send the token to a server.