JWT Decoder/ Client-side
Instantly decode JWT header and payload, view expiry and standard claims. Token never leaves your browser.
JWT Token
上の欄にJWTトークンを貼り付けてデコードしてください。
トークンはブラウザ外へ送信されません。
このツールは役に立ちましたか？
JWTとは
JWT（JSON Web Token）は、ヘッダー（アルゴリズム情報）、ペイロード（クレーム/データ）、署名の3つの部分で構成されるコンパクトでURLセーフなトークン形式です。主に認証に使用され、サーバーがJWTを発行し、クライアントがリクエストに含め、サーバーが署名を検証するだけでデータベース検索なしに身元を確認できます。
JWTのセキュリティに関する注意点
JWTのペイロードにはパスワードやクレジットカード番号などの機密情報を絶対に格納しないでください — ペイロードは単なるBase64エンコーディングで誰でも読み取れます。署名はデータの改ざん防止のみを保証し、機密性は保証しません。必ずHTTPSを使用し、適切な有効期限（15分〜1時間推奨）を設定し、リフレッシュトークンのローテーションを実装してください。
Code Examples
JavaScript (jsonwebtoken)
import jwt from 'jsonwebtoken';
// Sign
const token = jwt.sign(
{ sub: 'user_123', role: 'admin' },
process.env.JWT_SECRET,
{ expiresIn: '1h' }
);
// Verify
const payload = jwt.verify(
token, process.env.JWT_SECRET
);Python (PyJWT)
import jwt
# Sign
token = jwt.encode(
{"sub": "user_123", "exp": exp_ts},
secret,
algorithm="HS256"
)
# Verify
payload = jwt.decode(
token, secret,
algorithms=["HS256"]
)Go (golang-jwt)
import "github.com/golang-jwt/jwt/v5"
// Sign
token := jwt.NewWithClaims(
jwt.SigningMethodHS256,
jwt.MapClaims{"sub": "user_123"},
)
signed, _ := token.SignedString(secret)
// Verify
parsed, _ := jwt.Parse(signed,
func(t *jwt.Token) (any, error) {
return secret, nil
})Decode only (any language)
// JWT = base64url(header)
// + "."
// + base64url(payload)
// + "."
// + signature
function decodeJwt(token) {
const [h, p] = token.split('.');
const decode = s => JSON.parse(
atob(s.replace(/-/g,'+')
.replace(/_/g,'/'))
);
return { header: decode(h),
payload: decode(p) };
}Frequently Asked Questions
What is a JWT?
JWT (JSON Web Token) is an open standard (RFC 7519) for securely transmitting information as a JSON object. It consists of three Base64URL-encoded parts separated by dots: Header (algorithm & token type), Payload (claims), and Signature.
Can a JWT be forged?
The payload is only Base64URL-encoded — anyone can decode and read it. However, the signature cannot be forged without the secret key. JWT security relies entirely on signature verification; sensitive data should not be stored in the payload unless you use JWE (encrypted JWT).
What are exp, iat, and nbf?
These are standard JWT claims: exp (Expiration Time) is when the token expires; iat (Issued At) is when it was issued; nbf (Not Before) means the token is invalid before that time. All timestamps are Unix time (seconds since epoch).
Why can't signature verification be done in the browser?
Verification requires the secret key (for HMAC algorithms) or public key (for RSA/ECDSA). In a pure frontend context, these keys are typically unavailable. Signature verification should always be performed server-side in production.
What's the difference between HS256 and RS256?
HS256 (HMAC-SHA256) uses a single shared secret for both signing and verification — suitable for single-service setups. RS256 (RSA-SHA256) uses a private key to sign and a public key to verify — better for microservices where the public key can be distributed safely.
Is my token safe to paste here?
Yes. This tool runs entirely in your browser with no network requests — your token never leaves your device. That said, for production tokens containing sensitive claims, exercise caution and rotate them if you suspect exposure.