فاكّ تشفير JWT
فكّ تشفير JSON Web Token لفحص ترويسته ومطالباته. فك التشفير ليس تحققًا: لا يتم فحص التوقيع.
This tool only decodes the Base64URL-encoded parts of the token. The signature is NOT verified, so the contents shown here must not be trusted on their own. Anyone can create a token with arbitrary contents; only a verified signature proves authenticity. The token is processed locally and never stored or sent anywhere.
كيفية الاستخدام
Paste a JWT and press Decode. The header and payload are shown as JSON, and the exp, iat and nbf claims are displayed both as raw Unix timestamps and as ISO 8601 times. An exp in the past is flagged as expired. The signature is only displayed as text.
ملاحظات
Most important: decoding is not verification. This tool never checks the signature. Anyone can forge a JWT with arbitrary contents, so never treat what is shown here as trusted. Your token is processed only in your browser and is never stored or sent anywhere — but still handle live production tokens with the same care as any other secret.
الأسئلة الشائعة
Can this verify the signature?
No. Verification needs the issuer's key and belongs in a server-side library. This tool only decodes.
Is the payload encrypted?
No. A standard JWT (JWS) payload is only Base64URL-encoded and readable by anyone. Never put secrets in it.