JWT Decoder and Verifier은(는) 무엇을 하나요?
JWT Decoder and Verifier은(는) 브라우저에서 데이터 검사을(를) 수행하며 결과와 제한을 명확히 설명합니다. 검증된 기능: Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging.
Decode for inspection; verify before trust
Decoding is useful for debugging visible claims. Authentication requires an allowed algorithm, a valid signature, trusted key material, and application checks for issuer, audience, expiry, not-before time, and replay policy.
사용 방법
- Paste a three-part compact JWT into JWT compact token.
- For HS256, HS384, or HS512 only, enter the expected HMAC secret and select Decode and verify.
- Inspect alg, exp, the decoded claims, and signature status; apply issuer and audience checks in the receiving application.
실제 입출력 예시
Decode a compact HS256 token
입력
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c출력
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: Not checked until a secret is suppliedBase64url decoding reveals claims without proving that the token came from a trusted issuer.
일반적인 오류와 해결 방법
| 현상 | 가능한 원인 | 해결 방법 |
|---|---|---|
| The tool says a compact JWT must contain three segments. | The value is truncated, includes a Bearer prefix, or is an encrypted JWE with five segments. | Remove the Authorization header prefix and provide only a three-segment signed JWT. |
| The HMAC signature is invalid. | The secret, algorithm, or token bytes differ from those used by the signer. | Verify the expected issuer configuration; never change alg or accept an unverified token to make the check pass. |
Important behavior of JWT Decoder
이 도구의 구체적인 제한: Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
표준 및 구현 참고 자료
- RFC 7519 — JSON Web Token (JWT) (opens in a new tab)Defines JWT claims and compact token use.
- RFC 7515 — JSON Web Signature (JWS) (opens in a new tab)Defines the signed three-segment compact representation.
JWT Decoder — FAQ
Does the JWT Decoder upload my input?
No. Processing runs in the current browser tab, and the page does not send tool input to a KitLumi processing endpoint.
What input does the JWT Decoder accept?
It accepts a three-segment compact JWT and, for HS algorithms, an optional secret. The workspace checks the input and reports malformed or unsupported values before it produces a result.
What does the JWT Decoder produce?
It produces formatted header and claims, expiry state, algorithm, and verification status. Copy and download controls appear when the output format supports them.
What limitation should I know?
Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
변경 사항
실질적인 업데이트: JWT Decoder: Added Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging, responsive controls, explicit runtime disclosure, and task-specific examples and limitations.