MetoolzyJWT Decoder
Decode & Inspect
View header, payload, and signature.
Expiration Check
Shows if token is expired with timestamps.
No Verification
Decodes only — never sends token to server.
Client-side
All processing in your browser. No data uploaded.
关于JWT Decoder
JSON Web Tokens (JWTs) are a compact, URL-safe standard for transmitting signed claims between parties, defined in RFC 7519. A JWT consists of three Base64URL-encoded parts separated by dots: the header (algorithm and token type), the payload (claims such as user ID, roles, and expiration time), and the signature. They are widely used in authentication flows — an API server issues a JWT after login, and the client includes it in every subsequent request so the server can verify identity without querying a database. This decoder lets you instantly inspect any JWT's contents. Paste a token and the tool decodes and pretty-prints the header and payload as formatted JSON, so you can read all the claims at a glance. Timestamp claims (exp, iat, nbf) are automatically rendered as human-readable dates, and expired tokens are flagged in red. Importantly, this tool never sends your token to any server — everything is decoded locally in your browser. Signature verification is intentionally not performed, keeping the tool simple and safe for inspecting tokens without needing a secret key.
如何使用JWT Decoder
- Paste your JWT (starting with "eyJ...") into the text area at the top of the tool.
- The header and payload are decoded and displayed as formatted JSON automatically.
- Check the coloured badges near the top for expiration (exp), issued-at (iat), and not-before (nbf) times.
- A red "Expired" badge indicates the token's exp claim is in the past.
- Use the Copy buttons to copy the header or payload JSON to your clipboard.
- Inspect claim fields such as sub (subject/user ID), iss (issuer), and aud (audience) in the payload section.
常见问题
Does this tool verify JWT signatures?
No. This tool only decodes the Base64URL-encoded parts of the token — it does not verify the cryptographic signature. Signature verification requires the server's secret key or public certificate and should be done server-side.
Is it safe to paste my JWT here?
Be cautious with production tokens containing sensitive user data. This tool processes everything locally in your browser and never sends data to any server, but avoid pasting tokens from live production systems if possible. Use test or development tokens for inspection.
What are the standard JWT claims?
Common registered claims include: iss (issuer), sub (subject), aud (audience), exp (expiration time), nbf (not before), iat (issued at), and jti (JWT ID). Payloads often also include custom application-specific claims.
What does "exp" mean and why is it important?
The exp claim specifies the expiration time of the token as a Unix timestamp. After this time the token should no longer be accepted. This tool highlights expired tokens in red so you can immediately see if a token has lapsed.
What algorithms can JWTs use?
The algorithm is specified in the header's "alg" field. Common options are HS256 (HMAC-SHA256, symmetric), RS256 (RSA-SHA256, asymmetric), and ES256 (ECDSA-SHA256). The "none" algorithm is considered insecure and should be rejected by servers.
JWT Decoder 完全使用指南与免费在线工具
无需安装、完全免费、纯前端本地运行的高效 JWT Decoder 工具
用于快速解决：解码和检查JWT令牌。。无需安装复杂软件，打开网页即可立即使用，极速且安全。
为什么选择 Metoolzy 的 JWT Decoder？
- 秒级即时响应: 极致性能优化，输入即可见结果。
- 数据绝对安全: 纯浏览器本地计算，数据绝不上传服务器。
- 完全免费使用: 无需注册登录，无任何隐形消费。
三步快速上手
- 打开 Metoolzy JWT Decoder 工具页面。
- 在输入区粘贴或上传您的数据。
- 即时查看处理结果并点击复制或下载。
功能对比表
| 对比项 | Metoolzy JWT Decoder | 普通在线工具 | 本地客户端软件 |
|---|---|---|---|
| 使用成本 | 永久免费 | 有次数限制或收费 | 需购买授权 |
| 隐私保护 | 纯本地内存运行 | 数据需上传云端 | 本地运行 |
适用人群与应用场景
- 软件开发人员日常调试与数据转换
- UI/UX 设计师资产处理
- 运营与办公人员效率提升
常见问题解答 (FAQ)
处理的数据会被记录或保存吗？
绝不会。所有运算均在您的浏览器本地完成，没有任何数据回传。