DEV NO.007
JWT Decoder
Decode JWT header and payload, inspect expiry. Signature is not verified — nothing leaves your browser.
This tool runs entirely in your browser. Nothing is uploaded to any server.
What is this
什么是 JWT
JWT（JSON Web Token）由三段 Base64URL 组成：Header（算法）、Payload（声明）、Signature（签名）。它是无状态鉴权的标配，但不加密——任何拿到 Token 的人都能读出 Payload。
What is a JWT
A JWT has three Base64URL parts: header (algorithm), payload (claims) and signature. It is signed, not encrypted — anyone holding the token can read the payload.
如何使用
- 粘贴完整 JWT（三段式字符串）。
- 查看 Header、Payload 与签名段；iat / exp 自动转为可读时间。
- 过期 Token 会被明确标红提示。
FAQ
Does it verify the signature?
No. Decoding is not verification — validating a signature requires the secret and belongs on your server. This tool only shows the contents.
Is it safe to paste a JWT into a web tool?
With most online tools, no — the token is sent to a server. This one decodes in-browser with zero uploads. Still, treat tokens as sensitive credentials.
What does an exp like 1.7e9 mean?
It's a Unix timestamp in scientific notation. The tool converts iat/exp/nbf into readable dates.