رمزگشای JWT

What Is a JWT (JSON Web Token)?

A JSON Web Token (JWT) is a compact, URL-safe token format defined in RFC 7519. It encodes a set of claims as a JSON object, then signs — and optionally encrypts — it so the recipient can verify the data has not been tampered with. JWTs are the de facto standard for stateless authentication in REST APIs, single-sign-on systems, and microservice authorization.

JWT Anatomy: Header · Payload · Signature

Every JWT is three base64url-encoded segments separated by dots. The header and payload are plain JSON — readable by anyone — while the signature is a cryptographic value that can only be verified with the correct key.

{
  "alg": "HS256",
  "typ": "JWT"
}

{
  "sub":  "user123",
  "name": "Alice",
  "role": "admin",
  "iat":  1717200000,
  "exp":  1717203600
}

Why Use a JWT Decoder?

Raw JWTs look like random text. This tool instantly renders the header and payload as formatted JSON so you can inspect claims, check expiration times, and audit algorithm choices without writing a single line of code.

Standard JWT Claims Reference

RFC 7519 defines seven registered claim names. These are not required, but their use is strongly recommended for interoperability. You can add any custom claims to the payload.

JWT Signing Algorithms

The alg header claim declares which algorithm signed the token. The choice affects security, performance, and whether third-party services can verify tokens without the private key.

Security Considerations

Decoding a JWT is always safe. Trusting a JWT without proper signature verification is not. Keep these rules in mind whenever you consume tokens in your application.

Common Use Cases

Decoding JWT in Code

The header and payload are base64url-encoded — just reverse the encoding. Base64url replaces + with - and / with _, and omits = padding. Only the signature requires the secret key.

function decodeJWT(token) {
  const [, payload] = token.split('.')
  const json = atob(payload.replace(/-/g, '+').replace(/_/g, '/'))
  return JSON.parse(json)
}

const [, payload] = token.split('.')
const decoded = JSON.parse(
  Buffer.from(payload, 'base64url').toString()
)

import base64, json

def decode_jwt(token):
    payload = token.split('.')[1]
    padding = '=' * (-len(payload) % 4)
    return json.loads(base64.urlsafe_b64decode(payload + padding))

TOKEN="eyJhbGc..."
echo $TOKEN | cut -d. -f2 | base64 -d 2>/dev/null | jq .

Frequently Asked Questions