如何Encode JWT Tokens

问题

你需要创建 JWT 为 testing 或 understanding 令牌结构 used 在认证.

前置条件

• Understanding 的 JSON
• Knowledge 的 JWT 结构 (头.载荷.签名)

步骤

1. 1. Define the header and payload

   The header specifies the algorithm (HS256, RS256) and token type (JWT). The payload contains claims: standard (iss, sub, aud, exp, iat) and custom. Set an expiration (exp) to limit token lifetime. Do not put sensitive data in the payload — it is Base64-encoded, not encrypted.

   输入

   header: {alg:'HS256',typ:'JWT'} | payload: {sub:'123',exp:...}

   输出

   claims defined

2. 2. Encode and sign the token

   Base64url-encode the header and payload. Compute the signature by HMAC-SHA256 (for HS256) or RSA-SHA256 (for RS256) over the encoded header.payload. Concatenate as header.payload.signature. The signature ensures the token was not tampered with.

   输入

   header + payload + secret key

   输出

   eyJhbGciOi...eyJzdWIi...SflKxwR...

3. 3. Verify the token structure

   Decode the token and confirm the header and payload are valid JSON. Verify the signature matches by recomputing it. Check the expiration and other claims. Remember that JWT verification only proves the token was signed by the holder of the secret key — it does not encrypt the payload.

   输入

   JWT + secret

   输出

   signature valid, not expired

预期结果

有效, signed JWT 该能够是 verified 通过任何人具有签名键.

常见错误

Putting sensitive data in the payload

The JWT payload is Base64-encoded, not encrypted. Anyone can decode it. Never put passwords, secrets, or PII in the payload.

Missing expiration claim

Always set an exp claim to limit the token's lifetime. Tokens without expiration are valid indefinitely, which is a security risk if compromised.

排障指引

• If verification fails, check the algorithm, key, and that the token is not expired.
• Use HS256 for symmetric signing (shared secret) or RS256 for asymmetric (private key signs, public key verifies).

安全限制

• JWT payloads are readable by anyone. They provide integrity (tamper detection) but not confidentiality.
• This tool encodes and signs locally. Your secret key never leaves your browser.
• JWT is for local token inspection and testing, not for server-side authentication.