JWT トークンを検査・デコードする方法

问题

JWT を受け取ったが、署名鍵なしでその中身（クレーム、有効期限、発行者）を確認したいという状況です。

前提条件

• JWT 構造の理解
• Base64url エンコードに関する知識

ステップ

1. 1. Split the token into parts

   A JWT has three Base64url-encoded parts separated by dots: header.payload.signature. Split on the dot character. If there are not exactly three parts, it is not a valid JWT. The parts are Base64url-encoded (use - and _ instead of + and /, no padding).

   入力

   eyJhbGci...eyJzdWIi...SflKx...

   输出

   3 parts: header, payload, signature

2. 2. Decode the header and payload

   Base64url-decode the first part (header) and second part (payload) to JSON strings, then parse them. The header contains the algorithm and type. The payload contains claims like sub (subject), iss (issuer), exp (expiration), iat (issued at), and custom claims. The signature (third part) cannot be decoded to meaningful data without the key.

   入力

   decode parts

   输出

   header: {alg:'HS256'} | payload: {sub:'123',exp:1697254800}

3. 3. Interpret the claims

   Read the standard claims: exp (expiration timestamp — is the token still valid?), iat (issued at), nbf (not before), iss (issuer), aud (audience). Check custom claims for application-specific data. Remember: decoding does not verify the signature — the token could be forged. Always verify before trusting.

   入力

   exp: 1697254800 (past)

   输出

   token expired

期待される結果

デコードされて表示された JWT ヘッダーとペイロード。クレームの意味も解釈されます。

よくあるエラー

Treating a decoded token as verified

Decoding only reads the content. It does not prove the token was signed by the legitimate issuer. Always verify the signature before trusting the claims.

Base64url decoding fails

JWT uses Base64url encoding (with - and _ instead of + and /, no padding). Use a Base64url decoder, not a standard Base64 decoder. Restore padding before decoding if needed.

トラブルシューティング指引

• If decoding produces garbage, the parts may not be Base64url-encoded. Check the token format.
• If the token has extra parts (more than 3), it may be a JWE (encrypted) or a different format.

セキュリティ上の制限

• Decoding a JWT is safe — it only reads encoded data. But never trust the claims without signature verification.
• JWT inspection is for debugging and understanding. Do not make access control decisions based on unverified claims.
• This tool decodes locally. No token is transmitted.