Comment en Inspecter et Décoder JWT Tokens

问题

You received un JWT et vouloir en see its contents (claims, expiration, issuer) sans le signing clé.

Prérequis

• Understanding of JWT structure
• Knowledge of Base64url encoding

Étapes

1. 1. Split the token into parts

   A JWT has three Base64url-encoded parts separated by dots: header.payload.signature. Split on the dot character. If there are not exactly three parts, it is not a valid JWT. The parts are Base64url-encoded (use - and _ instead of + and /, no padding).

   entrée

   eyJhbGci...eyJzdWIi...SflKx...

   输出

   3 parts: header, payload, signature

2. 2. Decode the header and payload

   Base64url-decode the first part (header) and second part (payload) to JSON strings, then parse them. The header contains the algorithm and type. The payload contains claims like sub (subject), iss (issuer), exp (expiration), iat (issued at), and custom claims. The signature (third part) cannot be decoded to meaningful data without the key.

   entrée

   decode parts

   输出

   header: {alg:'HS256'} | payload: {sub:'123',exp:1697254800}

3. 3. Interpret the claims

   Read the standard claims: exp (expiration timestamp — is the token still valid?), iat (issued at), nbf (not before), iss (issuer), aud (audience). Check custom claims for application-specific data. Remember: decoding does not verify the signature — the token could be forged. Always verify before trusting.

   entrée

   exp: 1697254800 (past)

   输出

   token expired

Résultat attendu

Le JWT en-tête et payload decoded et displayed, avec claims interpreted.

Erreurs courantes

Treating a decoded token as verified

Decoding only reads the content. It does not prove the token was signed by the legitimate issuer. Always verify the signature before trusting the claims.

Base64url decoding fails

JWT uses Base64url encoding (with - and _ instead of + and /, no padding). Use a Base64url decoder, not a standard Base64 decoder. Restore padding before decoding if needed.

Dépannage指引

• If decoding produces garbage, the parts may not be Base64url-encoded. Check the token format.
• If the token has extra parts (more than 3), it may be a JWE (encrypted) or a different format.

Limites de sécurité

• Decoding a JWT is safe — it only reads encoded data. But never trust the claims without signature verification.
• JWT inspection is for debugging and understanding. Do not make access control decisions based on unverified claims.
• This tool decodes locally. No token is transmitted.