關於 JWT
解碼、簽名並驗證 JSON Web Token
Decoding only reads the header and payload; it does not establish who issued the token or whether its claims should be trusted. Verification must use the expected algorithm, key, issuer, audience, and application policy.
如何使用這個開發者工具
- Paste a JWT and decode the header, payload, and signature segments.
- For verification, select the algorithm and provide the matching test key or public key.
- Review exp, nbf, iat, issuer, audience, and algorithm decisions before relying on the result.
私隱與資料處理
JWT processing is designed to run locally. Never paste production signing keys, private keys, or live customer tokens into an online tool; use a redacted test token whenever possible.
相關開發者工具
常見問題
Does decoding a JWT verify it?
No. The first two JWT parts are Base64URL-encoded JSON and can be read without a key. Verification checks the signature with the expected key and algorithm.
What should I check besides the signature?
Check expiration, not-before, issuer, audience, algorithm, and the application rules that decide which claims are required.
Can a JWT contain a password?
It should not. JWT payloads are normally readable by whoever has the token, so keep secrets out of claims.