Wie in Inspizieren und Dekodieren JWT Tokens

问题

You received ein JWT und wollen in see its contents (claims, expiration, issuer) ohne der signing Schlüssel.

Voraussetzungen

• Understanding of JWT structure
• Knowledge of Base64url encoding

Schritte

1. 1. Split the token into parts

   A JWT has three Base64url-encoded parts separated by dots: header.payload.signature. Split on the dot character. If there are not exactly three parts, it is not a valid JWT. The parts are Base64url-encoded (use - and _ instead of + and /, no padding).

   Eingabe

   eyJhbGci...eyJzdWIi...SflKx...

   输出

   3 parts: header, payload, signature

2. 2. Decode the header and payload

   Base64url-decode the first part (header) and second part (payload) to JSON strings, then parse them. The header contains the algorithm and type. The payload contains claims like sub (subject), iss (issuer), exp (expiration), iat (issued at), and custom claims. The signature (third part) cannot be decoded to meaningful data without the key.

   Eingabe

   decode parts

   输出

   header: {alg:'HS256'} | payload: {sub:'123',exp:1697254800}

3. 3. Interpret the claims

   Read the standard claims: exp (expiration timestamp — is the token still valid?), iat (issued at), nbf (not before), iss (issuer), aud (audience). Check custom claims for application-specific data. Remember: decoding does not verify the signature — the token could be forged. Always verify before trusting.

   Eingabe

   exp: 1697254800 (past)

   输出

   token expired

Erwartetes Ergebnis

Der JWT Header und Payload decoded und displayed, mit claims interpreted.

Häufige Fehler

Treating a decoded token as verified

Decoding only reads the content. It does not prove the token was signed by the legitimate issuer. Always verify the signature before trusting the claims.

Base64url decoding fails

JWT uses Base64url encoding (with - and _ instead of + and /, no padding). Use a Base64url decoder, not a standard Base64 decoder. Restore padding before decoding if needed.

Troubleshooting指引

• If decoding produces garbage, the parts may not be Base64url-encoded. Check the token format.
• If the token has extra parts (more than 3), it may be a JWE (encrypted) or a different format.

Sicherheitsgrenzen

• Decoding a JWT is safe — it only reads encoded data. But never trust the claims without signature verification.
• JWT inspection is for debugging and understanding. Do not make access control decisions based on unverified claims.
• This tool decodes locally. No token is transmitted.