Hvad er JWT-afkoder?
En JWT (JSON Web Token) er the standard way modern web APIs represent authentication og authorization claims. It's en compact, self-contained token made af three dele — en header describing the signing algorithm, en payload carrying the actual claims (like user ID, roles, og expiration), og en signature den lets the receiving server verify the token hasn't been tampered with.
Denne decoder reads the header og payload øjeblikkeligt so du kan debug authentication issues, inspect hvad claims en API er actually sending, eller check når en token expires — alle without needing en backend, en CLI tool, eller pasting sensitive tokens ind i en third-party server, siden everything runs locally i din browser.
Hvornår skal du bruge denne regnemaskine
- Debugging hvorfor en API rejects en token ved inspecting dens claims og expiration time
- Markéring a token's expiration time during a support investigation or incident response
- Verifying den en SSO eller OAuth provider er issuing the claims din ansøgning expects
- Learning hvordan JWTs er structured for interview preparation eller security coursework
- Inspecting a token captured fra browser dev tools eller server logs to understand its contents
- Sammenligner the header algoritme mellem tokens til debug algorithm-mismatch authentication failures
Trin:
- Paste din JWT ind i the input box, eller click "Load Sample" til prøve one.
- Den header og payload er decoded automatically as du type.
- Review claims like iss, sub, exp, og iat i plain readable form.
- Timestamp claims (exp, iat, nbf) are automatically konverteret to readable dates.
Formel
JWT = base64Url(header) + "." + base64Url(payload) + "." + base64Url(signature)
Afkodning: del ved ".", base64Url-afkod de to første dele, fortolk som JSON.
Verificering (ikke udført her): HMACSHA256(base64Url(header) + "." + base64Url(payload), hemmelig) === signature
Anvendelsessager
- Debugging hvorfor an API rejects a token by inspecting its claims
- Markéring a token's expiration time during a support investigation
- Verifying en SSO eller OAuth provider er issuing the claims du forvente
- Learning hvordan JWTs er structured for interview prep eller coursework
- Quickly inspecting a token pasted fra browser dev tools eller server logs
Nøglefordele
- Dekodér any JWT instantly without a backend or CLI tool
- Everything runs client-side — tokens are aldrig sent to a server
- Automatiskally konverteres timestamp claims to readable dates
- Free, no sign-op, works til any JWT uanset of algorithm
Pro tips
- Tjek altid 'exp' første når debugging en "unauthorized" fejl — en expired token er the fleste fælles cause
- Cross-reference the 'alg' i the header med hvad din backend expects til catch algorithm-mismatch bugs
- Aldrig trust a decoded payload as proof of identity without verifying the signature server-side
- Brug short-lived tokens with refresh tokens instead of long-lived JWTs to limit exposure if one leaks
Almindelige fejl at undgå
- Antager a decoded JWT is a verified JWT — decoding only reads the content, it doesn't confirm authenticity
- Gemme følsomme data (adgangskoder, hemmeligheder) i payloaden og glemme at den er læsbar af alle
- Pasting production tokens ind i untrusted online decoders
- Forveksler 'exp' (expiration) with 'iat' (issued at) when debugging token lifetime issues
Nøglebegreber forklaret
- Claim: A piece of information asserted om a subject, like a user ID eller role
- Header: Den første JWT segment, specifying the signing algoritme og token type
- Payload: The anden JWT segment, containing the actual claims
- Signature: The tredje JWT segment, used to verify the token hasn't been altered
Relaterede begreber
- Hash-generator:
- UUID-generator:
- Base64-encoder/-decoder:
- JSON-formater:
- PassWord Strength Markérer:
Eksempel
Et token, der starter med eyJhbGciOiJIUzI1NiJ9, dekodes til et header af {"alg":"HS256","typ":"JWT"} — hvilket fortæller dig, at tokenet er signatureret med HMAC-SHA256.
Fortolkning af dine resultater
Den decoder splits the JWT på the two dot separators og Base64URL-decodes the første two segments. Den header tells du the signing algoritme (like HS256 eller RS256) og token type. Den payload contains the actual claims — user identity, permissions, og timestamps.
Timestamp claims (exp, iat, nbf) er automatically konvertereed fra Unix epoch til readable dates. If 'exp' shows en date i the past, the token er expired og fleste servers vil reject it. Den 'sub' (subject) claim typisk contains the user ID, og 'iss' (issuer) identifies the server den created the token.
Remember den decoding er ikke verification. Den signature section er displayed men cannot be verified without the secret eller public key. En decoded payload er informational kun — aldrig trust det as bevis af identity without server-side signature verification.