关于 JWT
解码、签名并验证 JSON Web Token
Decoding only reads the header and payload; it does not establish who issued the token or whether its claims should be trusted. Verification must use the expected algorithm, key, issuer, audience, and application policy.
如何使用这个开发者工具
- Paste a JWT and decode the header, payload, and signature segments.
- For verification, select the algorithm and provide the matching test key or public key.
- Review exp, nbf, iat, issuer, audience, and algorithm decisions before relying on the result.
隐私与数据处理
JWT processing is designed to run locally. Never paste production signing keys, private keys, or live customer tokens into an online tool; use a redacted test token whenever possible.
相关开发者工具
常见问题
Does decoding a JWT verify it?
No. The first two JWT parts are Base64URL-encoded JSON and can be read without a key. Verification checks the signature with the expected key and algorithm.
What should I check besides the signature?
Check expiration, not-before, issuer, audience, algorithm, and the application rules that decide which claims are required.
Can a JWT contain a password?
It should not. JWT payloads are normally readable by whoever has the token, so keep secrets out of claims.