Avkoda JWT-tokens och Inspektera Claims SäKert
Quick Answer
För att avkoda en JWT: klistra in token i JWT Decoder och header och payload visas omedelbart som formaterad JSON. Verktyget avkodar Base64URL-delarna lokalt —din token lämnar aldrig din browser. Kom ihåg: avkodning visar bara innehåll; den verifierar inte signature.
Introduction
En JWT (JSON Web Token) är ett kompakt, URL-säkert token-format använt för autentisering och informationsutbyte. En JWT har tre delar separerade med punkter: header.payload.signature. Header specificerar algoritmen, payload innehåller claims (user ID, roles, expiration) och signature bevisar att token inte manipulerats. Avkodning låter dig inspektera innehållet för debugging —men avkodning verifierar inte äkthet.
Step by Step
-
Open the JWT Decoder tool
Go to the JWT Decoder tool page. The tool accepts any JWT string (three Base64URL-encoded parts separated by dots).
-
Paste your JWT token
Paste the JWT into the input field. A typical JWT looks like: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyMSJ9.signature. The tool auto-detects the three parts.
-
Review the decoded header
The tool Base64URL-decodes the first part and displays it as JSON. The header typically contains 'alg' (algorithm, e.g., HS256) and 'typ' (type, usually 'JWT').
-
Review the decoded payload (claims)
The tool decodes the second part and displays the claims as formatted JSON. Common claims include 'sub' (subject/user ID), 'iat' (issued at), 'exp' (expiration), and 'role' (user role).
-
Check the signature (third part)
The tool shows the signature part. Note: decoding does NOT verify the signature. To verify, you need the signing key and a verification library. Never trust a JWT's claims without verifying the signature server-side.
Examples
Decode a simple JWT
Input: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyMSIsIm5hbWUiOiJBbGljZSIsImlhdCI6MTY5MzUyNjQwMH0.signature
Output: Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"user1","name":"Alice","iat":1693526400}
JWT with expiration claim
Input: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiIsImV4cCI6MTY5MzYxMjgwMH0.sig
Output: Header: {"alg":"HS256"}
Payload: {"sub":"admin","exp":1693612800}
Common Problems
- Confusing decode with verify —decoding a JWT only reads its contents; it does NOT prove the token is authentic. Always verify the signature server-side with the signing key.
- Trusting expired tokens —check the 'exp' claim and reject expired tokens. The 'exp' value is a Unix timestamp in seconds.
- Base64 vs Base64URL —JWT uses Base64URL encoding (no padding, - and _ instead of + and /). A standard Base64 decoder will fail on JWT parts.
- Sensitive data in payload —JWT payloads are readable by anyone who has the token. Do not store passwords, credit card numbers, or other secrets in the payload.
Tips
- Always verify the JWT signature server-side before trusting any claims —decoding alone is not authentication.
- Check the 'exp' (expiration) and 'nbf' (not before) claims to ensure the token is valid for the current time.
- Use short-lived tokens (15-60 minutes) with refresh tokens for long sessions —minimizes damage if a token is leaked.
- Use our JWT Decoder for safe, local debugging —your token never leaves your browser.