使用结果前如何检查？
未验证签名前也能读取载荷。过期时间是声明，不证明签发方可信；验证时应使用可信的 HMAC 密钥和预期算法，权限判断仍由实际应用负责。
JWT Decoder and Verifier可以处理什么？
JWT Decoder and Verifier 用于在浏览器中检查数据，并清楚显示处理结果和限制。 已核对的功能： Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging.
Decode for inspection; verify before trust
Decoding is useful for debugging visible claims. Authentication requires an allowed algorithm, a valid signature, trusted key material, and application checks for issuer, audience, expiry, not-before time, and replay policy.
如何使用？
- Paste a three-part compact JWT into JWT compact token.
- For HS256, HS384, or HS512 only, enter the expected HMAC secret and select Decode and verify.
- Inspect alg, exp, the decoded claims, and signature status; apply issuer and audience checks in the receiving application.
实际输入输出示例
Decode a compact HS256 token
输入
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c输出
Header: {"alg":"HS256","typ":"JWT"}
Payload: {"sub":"1234567890","name":"John Doe","iat":1516239022}
Signature: Not checked until a secret is suppliedBase64url decoding reveals claims without proving that the token came from a trusted issuer.
常见错误与修复方法
| 现象 | 可能原因 | 修复方法 |
|---|---|---|
| The tool says a compact JWT must contain three segments. | The value is truncated, includes a Bearer prefix, or is an encrypted JWE with five segments. | Remove the Authorization header prefix and provide only a three-segment signed JWT. |
| The HMAC signature is invalid. | The secret, algorithm, or token bytes differ from those used by the signer. | Verify the expected issuer configuration; never change alg or accept an unverified token to make the check pass. |
Important behavior of JWT Decoder
该工具的实际边界： Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
标准与实现参考
- RFC 7519 — JSON Web Token (JWT) (opens in a new tab)Defines JWT claims and compact token use.
- RFC 7515 — JSON Web Signature (JWS) (opens in a new tab)Defines the signed three-segment compact representation.
关于JWT Decoder的常见问题
Does the JWT Decoder upload my input?
No. Processing runs in the current browser tab, and the page does not send tool input to a KitLumi processing endpoint.
What input does the JWT Decoder accept?
It accepts a three-segment compact JWT and, for HS algorithms, an optional secret. The workspace checks the input and reports malformed or unsupported values before it produces a result.
What does the JWT Decoder produce?
It produces formatted header and claims, expiry state, algorithm, and verification status. Copy and download controls appear when the output format supports them.
What limitation should I know?
Decoding alone does not establish authenticity. Trust a token only after issuer, audience, algorithm, and signature policy checks.
更新记录
本次实质更新： JWT Decoder: Added Offline JWT decoding, Expiration inspection, HS256/384/512 verification, No token logging, responsive controls, explicit runtime disclosure, and task-specific examples and limitations. 2026-10-15：补充结果检查步骤和具体能力边界。