JWT解码器
Decode JWT headers and payloads online for inspection without treating decoded claims as verified or trusted. 简体中文 locale.
Make HTML structure easier to inspect
This tool decodes the visible header and payload parts of a JSON Web Token so you can inspect their JSON fields. Decoding ...
Formatting is not HTML validation
A compact JWT commonly contains a header, payload, and signature separated by dots. The first two parts use a URL-safe Bas...
How to format HTML
- Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
- Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
Formatting method
- Read markup structure
The decoder splits the token at separators, decodes the first two URL-safe Base64 parts, and parses JSON when possible. It...
- Apply indentation
The decoder splits the token at separators, decodes the first two URL-safe Base64 parts, and parses JSON when possible. It...
- Preserve content
The decoder splits the token at separators, decodes the first two URL-safe Base64 parts, and parses JSON when possible. It...
Exact parser recovery, optional-tag handling, whitespace policy, embedded-language behavior, and error wording should be c...
Read the formatted result
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
常见错误
Common mistakes include trusting decoded roles, ignoring exp and nbf, accepting alg from the token, confusing decoding wit...
Common mistakes include trusting decoded roles, ignoring exp and nbf, accepting alg from the token, confusing decoding wit...
限制和特殊情况
The decoder cannot verify signatures, fetch keys, decrypt JWE content, detect revocation, or decide authorization. Clock s...
The decoder cannot verify signatures, fetch keys, decrypt JWE content, detect revocation, or decide authorization. Clock s...
Examples
JWT Decoder online — 1
Does decoding verify a JWT?
Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
JWT Decoder online — 2
Can it decrypt an encrypted token?
Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
JWT Decoder online — 3
Are claims trustworthy after decoding?
Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
JWT Decoder online — 4
What are header and payload parts?
Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
JWT Decoder online — 5
What does exp mean?
Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
JWT Decoder online — 6
Should I paste a production token?
Paste a token, inspect header and payload, and check the decoded JSON. Do not paste production secrets into an untrusted t...
A readable payload shows what the token carries at the time of decoding. It does not show whether the token is authentic, ...
Frequently asked questions
Does decoding verify a JWT?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
Can it decrypt an encrypted token?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
Are claims trustworthy after decoding?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
What are header and payload parts?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
What does exp mean?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
Should I paste a production token?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
Can the tool verify a signature?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...
How do I validate a token?
No. Decoding reveals token contents only. Verify the signature and claims with trusted keys, issuer rules, audience checks...