Acerca de JWT
Decode, sign, and verify JSON Web Tokens
Decoding only reads the header and payload; it does not establish who issued the token or whether its claims should be trusted. Verification must use the expected algorithm, key, issuer, audience, and application policy.
Cómo usar esta herramienta de desarrollo
- Paste a JWT and decode the header, payload, and signature segments.
- For verification, select the algorithm and provide the matching test key or public key.
- Review exp, nbf, iat, issuer, audience, and algorithm decisions before relying on the result.
Privacidad y tratamiento de datos
JWT processing is designed to run locally. Never paste production signing keys, private keys, or live customer tokens into an online tool; use a redacted test token whenever possible.
Herramientas de desarrollo relacionadas
Preguntas frecuentes
Does decoding a JWT verify it?
No. The first two JWT parts are Base64URL-encoded JSON and can be read without a key. Verification checks the signature with the expected key and algorithm.
What should I check besides the signature?
Check expiration, not-before, issuer, audience, algorithm, and the application rules that decide which claims are required.
Can a JWT contain a password?
It should not. JWT payloads are normally readable by whoever has the token, so keep secrets out of claims.