JWT 解碼器
解碼 JSON Web Token 以查看其標頭和宣告。解碼不等於驗證：不會檢查簽章。
This tool only decodes the Base64URL-encoded parts of the token. The signature is NOT verified, so the contents shown here must not be trusted on their own. Anyone can create a token with arbitrary contents; only a verified signature proves authenticity. The token is processed locally and never stored or sent anywhere.
使用方法
Paste a JWT and press Decode. The header and payload are shown as JSON, and the exp, iat and nbf claims are displayed both as raw Unix timestamps and as ISO 8601 times. An exp in the past is flagged as expired. The signature is only displayed as text.
注意事項
Most important: decoding is not verification. This tool never checks the signature. Anyone can forge a JWT with arbitrary contents, so never treat what is shown here as trusted. Your token is processed only in your browser and is never stored or sent anywhere — but still handle live production tokens with the same care as any other secret.
常見問題
Can this verify the signature?
No. Verification needs the issuer's key and belongs in a server-side library. This tool only decodes.
Is the payload encrypted?
No. A standard JWT (JWS) payload is only Base64URL-encoded and readable by anyone. Never put secrets in it.