JWT Decoder and Verifier は何をしますか？
JWT Decoder and Verifier はブラウザ上でデータを調査するツールで、結果と制限を明確に示します。 検証済みの機能： Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging.
Decode for inspection; verify before trust
Decoding is useful for debugging visible claims. Authentication requires an allowed algorithm, a valid signature, trusted key material, and application checks for issuer, audience, expiry, not-before time, and replay policy.
使い方
- Paste a three-part compact JWT into JWT compact token.
- For HS256, HS384, or HS512 only, enter the expected HMAC secret and select Decode and verify.
- Inspect alg, exp, the decoded claims, and signature status; apply issuer and audience checks in the receiving application.
実際の入出力例
Decode a compact HS256 token
入力
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c出力
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: Not checked until a secret is suppliedBase64url decoding reveals claims without proving that the token came from a trusted issuer.
一般的なエラーと対処
| 症状 | 原因 | 対処 |
|---|---|---|
| The tool says a compact JWT must contain three segments. | The value is truncated, includes a Bearer prefix, or is an encrypted JWE with five segments. | Remove the Authorization header prefix and provide only a three-segment signed JWT. |
| The HMAC signature is invalid. | The secret, algorithm, or token bytes differ from those used by the signer. | Verify the expected issuer configuration; never change alg or accept an unverified token to make the check pass. |
Important behavior of JWT Decoder
このツール固有の制限： Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
標準と実装の参考資料
- RFC 7519 — JSON Web Token (JWT) (opens in a new tab)Defines JWT claims and compact token use.
- RFC 7515 — JSON Web Signature (JWS) (opens in a new tab)Defines the signed three-segment compact representation.
JWT Decoder — FAQ
Does the JWT Decoder upload my input?
No. Processing runs in the current browser tab, and the page does not send tool input to a KitLumi processing endpoint.
What input does the JWT Decoder accept?
It accepts a three-segment compact JWT and, for HS algorithms, an optional secret. The workspace checks the input and reports malformed or unsupported values before it produces a result.
What does the JWT Decoder produce?
It produces formatted header and claims, expiry state, algorithm, and verification status. Copy and download controls appear when the output format supports them.
What limitation should I know?
Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
更新内容
実質的な更新： JWT Decoder: Added Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging, responsive controls, explicit runtime disclosure, and task-specific examples and limitations.