¿Qué hace JWT Decoder and Verifier?
JWT Decoder and Verifier permite inspeccionar datos directamente en el navegador y explica con claridad el resultado y sus límites. Capacidades verificadas: Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging.
Decode for inspection; verify before trust
Decoding is useful for debugging visible claims. Authentication requires an allowed algorithm, a valid signature, trusted key material, and application checks for issuer, audience, expiry, not-before time, and replay policy.
¿Cómo se utiliza?
- Paste a three-part compact JWT into JWT compact token.
- For HS256, HS384, or HS512 only, enter the expected HMAC secret and select Decode and verify.
- Inspect alg, exp, the decoded claims, and signature status; apply issuer and audience checks in the receiving application.
Ejemplo real de entrada y salida
Decode a compact HS256 token
Entrada
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cSalida
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: Not checked until a secret is suppliedBase64url decoding reveals claims without proving that the token came from a trusted issuer.
Errores frecuentes y soluciones
| Síntoma | Causa probable | Solución |
|---|---|---|
| The tool says a compact JWT must contain three segments. | The value is truncated, includes a Bearer prefix, or is an encrypted JWE with five segments. | Remove the Authorization header prefix and provide only a three-segment signed JWT. |
| The HMAC signature is invalid. | The secret, algorithm, or token bytes differ from those used by the signer. | Verify the expected issuer configuration; never change alg or accept an unverified token to make the check pass. |
Important behavior of JWT Decoder
Límite específico de esta herramienta: Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
Estándares y referencias de implementación
- RFC 7519 — JSON Web Token (JWT) (opens in a new tab)Defines JWT claims and compact token use.
- RFC 7515 — JSON Web Signature (JWS) (opens in a new tab)Defines the signed three-segment compact representation.
JWT Decoder — FAQ
Does the JWT Decoder upload my input?
No. Processing runs in the current browser tab, and the page does not send tool input to a KitLumi processing endpoint.
What input does the JWT Decoder accept?
It accepts a three-segment compact JWT and, for HS algorithms, an optional secret. The workspace checks the input and reports malformed or unsupported values before it produces a result.
What does the JWT Decoder produce?
It produces formatted header and claims, expiry state, algorithm, and verification status. Copy and download controls appear when the output format supports them.
What limitation should I know?
Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
¿Qué cambió?
Actualización material: JWT Decoder: Added Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging, responsive controls, explicit runtime disclosure, and task-specific examples and limitations.