JWT Decoder
Inspect header, payload and expiry — no secret required or accepted
トークンのデコードのみを行います。署名の検証には署名鍵が必要なため実行しません。署名用の秘密鍵をウェブページに貼り付けないでください。
上に入力すると結果が表示されます。
すべての処理はブラウザ内で完結します。データが端末外に送信されることはありません。
関連ツール
使い方
A JWT is three Base64URL segments separated by dots: header, payload and signature. The first two are merely encoded, not encrypted, so anyone holding the token can read every claim inside it.
Paste the token
Include all three segments. If you copied from an Authorization header, drop the leading "Bearer " — the token itself starts at eyJ.
Read the header
The alg claim names the signing algorithm and kid identifies which key was used. An alg of "none" is a red flag and should never be accepted by a server.
Read the payload
These are the claims your application acts on — typically sub for the subject, plus roles or scopes. Registered time claims iat, exp and nbf are resolved to dates for you.
Check the expiry badge
Expiry is computed from exp against your device clock. A token showing as expired when the server accepts it usually means your system clock has drifted.
使用例
A standard access token
A typical token decodes to a header of {"alg":"HS256","typ":"JWT"} and a payload carrying sub, name, iat and exp. The exp value 1753003600 resolves to a readable date and drives the expiry badge.
Why claims are not secret
Base64URL is an encoding, not encryption. Any claim you place in a payload — email address, internal user ID, role — is readable by anyone who obtains the token. Put nothing sensitive in a JWT.
このツールについて
Decode a JSON Web Token to read its header and claims, with registered time claims resolved to readable dates and expiry state shown at a glance. The tool decodes only and never verifies signatures, because verification would require your signing key and no web page should ever ask for one.