JWT decoder and verifier
Read what a JSON Web Token carries — its header, claims and expiry — and check its signature with the secret or public key. The token is decoded in your browser and never sent.
A JWT is signed, not encrypted: anyone who holds it can read the payload. Tokens are also credentials — this page sends nothing, but treat real ones like passwords.
完全在你的浏览器中运行 — 不会发送到任何地方
The three parts
header.payload.signature — the header names the algorithm, the payload holds the claims (sub, exp, iat and so on), and the signature covers the first two. exp, nbf and iat are seconds since 1970, shown here in your time zone.
Can anyone read my JWT?
Yes. The header and payload are only Base64URL-encoded. The signature stops them being changed, not read — so never put secrets in a JWT.
Why is “alg: none” dangerous?
It declares the token unsigned. A server that honours it will accept a token anyone wrote. Servers should fix the algorithms they accept rather than trusting the header.
Is the token sent anywhere?
No. Decoding and verification run in your browser.