如何Inspect 和 Decode JWT Tokens

问题

你 received JWT 和 want 到 see 其 contents (claims, expiration, issuer) 无签名键.

前置条件

• Understanding 的 JWT 结构
• Knowledge 的 Base64url 编码

步骤

1. 1. Split the token into parts

   A JWT has three Base64url-encoded parts separated by dots: header.payload.signature. Split on the dot character. If there are not exactly three parts, it is not a valid JWT. The parts are Base64url-encoded (use - and _ instead of + and /, no padding).

   输入

   eyJhbGci...eyJzdWIi...SflKx...

   输出

   3 parts: header, payload, signature

2. 2. Decode the header and payload

   Base64url-decode the first part (header) and second part (payload) to JSON strings, then parse them. The header contains the algorithm and type. The payload contains claims like sub (subject), iss (issuer), exp (expiration), iat (issued at), and custom claims. The signature (third part) cannot be decoded to meaningful data without the key.

   输入

   decode parts

   输出

   header: {alg:'HS256'} | payload: {sub:'123',exp:1697254800}

3. 3. Interpret the claims

   Read the standard claims: exp (expiration timestamp — is the token still valid?), iat (issued at), nbf (not before), iss (issuer), aud (audience). Check custom claims for application-specific data. Remember: decoding does not verify the signature — the token could be forged. Always verify before trusting.

   输入

   exp: 1697254800 (past)

   输出

   token expired

预期结果

JWT 头和 载荷 decoded 和 displayed, 具有 claims interpreted.

常见错误

Treating a decoded token as verified

Decoding only reads the content. It does not prove the token was signed by the legitimate issuer. Always verify the signature before trusting the claims.

Base64url decoding fails

JWT uses Base64url encoding (with - and _ instead of + and /, no padding). Use a Base64url decoder, not a standard Base64 decoder. Restore padding before decoding if needed.

排障指引

• If decoding produces garbage, the parts may not be Base64url-encoded. Check the token format.
• If the token has extra parts (more than 3), it may be a JWE (encrypted) or a different format.

安全限制

• Decoding a JWT is safe — it only reads encoded data. But never trust the claims without signature verification.
• JWT inspection is for debugging and understanding. Do not make access control decisions based on unverified claims.
• This tool decodes locally. No token is transmitted.