ZYBERMART

Instalar o ZYBERMART

Abra qualquer ferramenta pela tela inicial ou pelo Dock, em uma janela própria. As ferramentas que você já usou também funcionam offline.

Decodificador de JWT

Decodifique um JSON Web Token para ler o cabeçalho e as claims, ver quando expira e verificar assinaturas HS256.


        

        

            
            

        

    

    

    

        
        
    

    








    
What's inside a JWT

    
A JSON Web Token has three parts separated by dots:

    
    
        
  1. Header: the token type and signing algorithm, such as {"alg":"HS256","typ":"JWT"}.
    2. 
        
  2. Payload: the claims, such as the user ID (sub), roles and expiry time (exp).
    3. 
        
  3. Signature: a hash of the header and payload made with a secret or private key.
    4. 
    

    
The header and payload are Base64URL-encoded JSON, which is why this tool can decode them without any key.


    
Common registered claims

    

        

            
ClaimMeaning

            
                
issIssuer: who created the token

                
subSubject: usually the user ID

                
audAudience: who the token is meant for

                
expExpiration time (Unix timestamp)

                
nbfNot valid before (Unix timestamp)

                
iatIssued at (Unix timestamp)

                
jtiUnique token ID

            
        

    

    
Need to read a timestamp on its own? Use the Unix timestamp converter.






    
Frequently asked questions

        

            Is it safe to paste a real token here?
            
Yes. The token is decoded entirely in your browser and is never sent anywhere. Still, treat live tokens like passwords: anyone who has one can use it until it expires.

        

        

            Is a JWT encrypted?
            
Usually not. A standard JWT (JWS) is only signed: the header and payload are Base64URL-encoded, so anyone can read them. The signature proves the token wasn't changed, but it doesn't hide the contents. Never put secrets in a JWT payload.

        

        

            What do exp, iat and nbf mean?
            
They're Unix timestamps. exp is when the token expires, iat is when it was issued, and nbf (not before) is when it becomes valid. The decoder shows each as a readable date and tells you whether the token is currently valid.

        

        

            Can I verify the signature?
            
For HS256, HS384 and HS512 tokens, enter the shared secret and the decoder checks the signature using your browser's Web Crypto API. Tokens signed with RS256 or ES256 need the issuer's public key and are decoded but not verified here.

        

    





    
        

        
Ferramentas relacionadas

        

    






    


    
    


    

        
            

                
Entrar no ZYBERMART

                
            

            
Tenha seus currículos, faturas, flashcards, notas e ferramentas salvas em todos os seus dispositivos. É grátis, e as ferramentas funcionam igual sem conta.

            
            
ou

            

                
                
            

            

            
Não precisa de senha. Ao entrar, você concorda com os termos; veja como tratamos seus dados na política de privacidade.

        
        
            

                
Sua conta

                
            

            

            

            
            
Ao sair, uma cópia do seu trabalho fica neste navegador. Em um computador compartilhado, limpe os dados do navegador depois.

        

    
        

            
O que você quer criar?

            
        

            
Designs

            
            
Redes sociais

            
            
Documentos

            
            
Estudos

            
            
Editar

            
        Ver todas as 282 ferramentas