O que JWT Decoder and Verifier faz?
JWT Decoder and Verifier permite inspecionar dados diretamente no navegador e informa com clareza o resultado e os limites. Recursos verificados: Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging.
Decode for inspection; verify before trust
Decoding is useful for debugging visible claims. Authentication requires an allowed algorithm, a valid signature, trusted key material, and application checks for issuer, audience, expiry, not-before time, and replay policy.
Como usar?
- Paste a three-part compact JWT into JWT compact token.
- For HS256, HS384, or HS512 only, enter the expected HMAC secret and select Decode and verify.
- Inspect alg, exp, the decoded claims, and signature status; apply issuer and audience checks in the receiving application.
Exemplo real de entrada e saída
Decode a compact HS256 token
Entrada
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cSaída
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: Not checked until a secret is suppliedBase64url decoding reveals claims without proving that the token came from a trusted issuer.
Erros comuns e correções
| Sintoma | Causa provável | Correção |
|---|---|---|
| The tool says a compact JWT must contain three segments. | The value is truncated, includes a Bearer prefix, or is an encrypted JWE with five segments. | Remove the Authorization header prefix and provide only a three-segment signed JWT. |
| The HMAC signature is invalid. | The secret, algorithm, or token bytes differ from those used by the signer. | Verify the expected issuer configuration; never change alg or accept an unverified token to make the check pass. |
Important behavior of JWT Decoder
Limite específico desta ferramenta: Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
Padrões e referências de implementação
- RFC 7519 — JSON Web Token (JWT) (opens in a new tab)Defines JWT claims and compact token use.
- RFC 7515 — JSON Web Signature (JWS) (opens in a new tab)Defines the signed three-segment compact representation.
JWT Decoder — FAQ
Does the JWT Decoder upload my input?
No. Processing runs in the current browser tab, and the page does not send tool input to a KitLumi processing endpoint.
What input does the JWT Decoder accept?
It accepts a three-segment compact JWT and, for HS algorithms, an optional secret. The workspace checks the input and reports malformed or unsupported values before it produces a result.
What does the JWT Decoder produce?
It produces formatted header and claims, expiry state, algorithm, and verification status. Copy and download controls appear when the output format supports them.
What limitation should I know?
Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
O que mudou?
Atualização material: JWT Decoder: Added Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging, responsive controls, explicit runtime disclosure, and task-specific examples and limitations.