JWT トークンをエンコードする方法

问题

テストや、認証で使われるトークン構造の理解のために、JWT を作成する必要があります。

前提条件

• JSON の理解
• JWT 構造（header.payload.signature）に関する知識

ステップ

1. 1. Define the header and payload

   The header specifies the algorithm (HS256, RS256) and token type (JWT). The payload contains claims: standard (iss, sub, aud, exp, iat) and custom. Set an expiration (exp) to limit token lifetime. Do not put sensitive data in the payload — it is Base64-encoded, not encrypted.

   入力

   header: {alg:'HS256',typ:'JWT'} | payload: {sub:'123',exp:...}

   输出

   claims defined

2. 2. Encode and sign the token

   Base64url-encode the header and payload. Compute the signature by HMAC-SHA256 (for HS256) or RSA-SHA256 (for RS256) over the encoded header.payload. Concatenate as header.payload.signature. The signature ensures the token was not tampered with.

   入力

   header + payload + secret key

   输出

   eyJhbGciOi...eyJzdWIi...SflKxwR...

3. 3. Verify the token structure

   Decode the token and confirm the header and payload are valid JSON. Verify the signature matches by recomputing it. Check the expiration and other claims. Remember that JWT verification only proves the token was signed by the holder of the secret key — it does not encrypt the payload.

   入力

   JWT + secret

   输出

   signature valid, not expired

期待される結果

署名鍵を持つ誰もが検証できる、有効な署名済み JWT。

よくあるエラー

Putting sensitive data in the payload

The JWT payload is Base64-encoded, not encrypted. Anyone can decode it. Never put passwords, secrets, or PII in the payload.

Missing expiration claim

Always set an exp claim to limit the token's lifetime. Tokens without expiration are valid indefinitely, which is a security risk if compromised.

トラブルシューティング指引

• If verification fails, check the algorithm, key, and that the token is not expired.
• Use HS256 for symmetric signing (shared secret) or RS256 for asymmetric (private key signs, public key verifies).

セキュリティ上の制限

• JWT payloads are readable by anyone. They provide integrity (tamper detection) but not confidentiality.
• This tool encodes and signs locally. Your secret key never leaves your browser.
• JWT is for local token inspection and testing, not for server-side authentication.