Décodeur et inspecteur JWT
Décodez l'en-tête et la charge utile d'un JWT et vérifiez son expiration. Le jeton ne quitte jamais votre navigateur. Tout le traitement se fait dans votre navigateur ; vos données ne sont jamais envoyées au serveur.
A JWT is three base64url segments joined by dots: a header describing the algorithm, a payload carrying the claims, and a signature. The first two are only encoded, not encrypted — anyone holding the token can read them. This decoder shows you exactly what a token is carrying and whether it has expired, without sending it anywhere.
Comment l'utiliser
- Paste the whole token, including both dots. Leading "Bearer " is fine to remove first.
- The header and payload appear as formatted JSON as soon as the token parses.
- If the payload has an exp claim, the tool converts it to a real date and tells you whether the token is still valid.
- Read the claims you care about: sub for the subject, iat for issue time, aud for audience, scope or roles for permissions.
Questions fréquentes
- Does this verify the signature?
- No, and that is deliberate. Verifying requires the secret or public key, and you should never paste a signing secret into a web page. This tool decodes and inspects; verification belongs in your backend.
- Is it safe to paste a real token here?
- The token never leaves your browser — decoding is pure JavaScript on this page. That said, a JWT is a credential; treat it like a password and avoid pasting production tokens into any tool you have not audited.
- Why does my token show as expired when it works?
- exp is in seconds since the Unix epoch and is compared against your device clock. If your system time is wrong, the verdict will be wrong too.
- Can I edit the payload and re-sign it?
- Not here. Changing the payload invalidates the signature, and producing a new valid signature requires the key. That is the entire point of the format.