格 千格 KiloCell

JWT Decoding Full Guide: Read Header, Payload and Signature

Update 2026-08-08 About 12 minutes development tools How-to

When the JAB returns 401, the front-end "entry is not valid" or the back-end says "Token is wrong", the first step in the most time-saving period is not to change the business code, but to put JWT first. Open it and see it.: What's the algorithm?exp Has it been passed,sub/roles Responsive. This guidance describes the JWT structure, decodes and the marked boundary, gives an actionable step and error table and directly connects to the KiloCell local decoder tool.

Use tools immediately JWT Decoding - Header / Payload, optional HS256
Open tool →

The core sentence.

The first two paragraphs of JWT are decodeable statements, not encrypted safes; Only the signature is protected against tampering.

The code will tell you what it says, and it's not expired. The answer is "Is the key changed or not?" Both are done, and business terms and strategies are discussed. Here, you can click on the "Structure and ease of assembly concept, operation, error, scene, selection" and then you can go directly in. JWT decoder Up against practice.

1. What is JWT, what is it?

JWT is a kind of a... Statement (claims) Encoding in a transferable string format, which is commonly used in login, API authorizations, and calls between services. The standard form is divided into three parts with two dots:

header.payload.signature
Paragraph Contents Can you be understood? Role
Header Metadata such as type, algorithm Yes (Base64URL decode) Tell the checker how to do it.
Payload Operational and standard statements Yes (Base64URL decode) Carrying identity, expiry, authority, etc.
Signature A code digest of the first two paragraphs Show only original string Prejudiced, key-fixed.

Not encrypted. Header and Payload only do Base64URL encoding, and anyone who gets the full Token can read JSON with a decoding device. The entry of a password, ID number, bank card in Payload is an explicit outgoing transmission. The need for confidentiality should be based on the use of encrypted access and sensitive data kept by the service, rather than on the expectation that "JWT seems to be out of order".

Not the session itself. JWT is often used as a carrier for a non-state session: the service does not have a session list, only the signature and declaration are verified. This creates horizontal expansion and problems of "release after issuance" — revocation, blacklist, short expiry — and re-enacting tokens are a different layer of design, and decode tools cannot solve strategic problems, but they can help you to confirm what is written in this Token.

2. Standard statements and the fields you really should be looking at

The common registration statements in Payload are as follows, which are given priority in the alignment, and then in the business self-defined fields.

Statement Meaning How to use debugging
iss Issuer Whether or not to point to the correct authentication service
sub Subject (often user ID) Whether to match current login user
aud Audience Whether to send the correct API client
exp Expiry time (Unix seconds) First evidence of 401 "expired".
nbf Time of entry into force Clock/ Advance Token "not yet in force"
iat Time of issue Is it abnormally ahead or behind the server time?
jti Token's only ID Revocation list, position when re-set

Business fields vary by project, for example roles、scope、tenant_id。 Check it out after decoded. Type and level: Numbers 1 With String "1"The number of people who have access to the Internet is one of the most important things that can be said to be the result of the fact that the number of people who have access to the Internet is one of the most important things.

Time fields almost always Second Unix TimestampNot milliseconds. - Put it on. exp When mscreen is analyzed, the miscalculated sentence is "unexpired" when it is a distant future or a ridiculous date. The KiloCell decoder is deciphering to exp/iat , and reduce the number of heart errors.

Base64, Base64URL, Encryption: Three of the easiest concepts to mix

JWT Usage Base64URL(RFC 4648): Usage -/_ Alternative +//, often omitted = Fill, easily put in URL with Header. It's not the same set of characters as normal Base64.

Concept What did you do? Confidentiality Typical tool
Base64 / Base64URL Binary ↔ Printable Text Yes Base64 toolsInside the JWT decoder
Encryption (e. g. AES) Unreadable Unread Key Yes (in the context of key security) Not within the "Code" JWT.
Signature (HMAC/RSA etc.) Proof that the content has not been altered, from the key holder Do not hide Payload content Codec optional HS256 authentication

Therefore:

  • Just "see Payload" decode, no key.
  • To confirm that "not changed, key pair" requires a signature and algorithm matches the key type.
  • Throws the whole JWT into the normal Base64 decoding device, often failing because of URL security characters and missing fills; Priority should be given to special purpose JWT decoder。

4. Decoding in KiloCell: step by step

tools page:JWT decoder。 Processing done locally in browsers; It is still recommended that the production of Token be dissensitized or that the test account number be used.

  1. Open tool。 Enter /tools/dev/jwt-decoder, confirm that the text box "Input JWT tokens" is visible.
  2. Ready, Token. From Authorization: Bearer … Only copy in Token BodyThree, two points, no. Bearer Prefix or quotation marks, line breaks.
  3. Paste is the resolution. Input Box Support oninput Real time decode: the three districts will be shown separately when success is achieved; Watch the status bar error hint when you fail.
  4. Read Payload first. Focus. exp Local time next to the "expired/ valid" comment, read sub, custom role fields.
  5. Read Header again. Confirm. alg(if HS256、RS256) and typ。 When the algorithm is not aligned with the backend configuration, the check-in or gateway will be refused directly.
  6. Optional: HS256 Signing. Just you. Clearly holds shared key And, Hyader is HS256 , and then insert the key in the " Verify your signature" box. Valid by displaying the signature; Failure is the key error, Token is changed, or it is not issued at all.
  7. Copy JSON if needed. The following is a video of the event: To be further beautiful or Diff, stickable JSON Format。

Tool capacity boundaries (relative pages)

  • Support: Base64URL decoded for three-part JWT, presentation of the Header/Payload format,exp/iat Readable time, local HS256 check.
  • I don't claim to support: Checksums fully covered by any algorithm (page is clear: currently the authentication focuses on HS256）； The RSA/EDSSA public key certification requires other tool chains.
  • No substitute: Service-end authoritative verification, HTTPS, key rotation and revocation strategy.

5. Common issues and approaches

phenomena Common causes What do we do?
Inactive format of hint (not three parts) Copy that. Bearer Prefixes, nodes, sticky lines, only half a bit of copy. Keep Only a.b.c Three paragraphs; Remove the spaces and quotes.
Parsing failed / JSON error Some part of the section is not legal, Base64URL, or is cut off by the gateway. Recopy complete from network panel
Show Expiry exp Earlier than the current time; Or no client clock. Refresh login for new Token; Check this machine time with NTP
Not expired and not yet expired 401 aud/iss No match, no permissions, no. The gateway is checked. Decoding confirmation statements before checking service-end policies and intermediates
HS256 Signing Failed Key error, multispace, Token modified, RS256 Check alg； RS256 Do not press HMAC keys
Checkpoint hint only supports HS256 Header's... RS256 Wait. Decoded to read the content; Verifying to replace with the corresponding public key tool or backend log
Payload "A field but no frontend" Embedded path, inconsistent type, error resolution library Copy Payload to JSON tool to check paths and types
As soon as the signature changes Payload, it changes. Fit design: Sign first two paragraphs The rectification must be signed by the issuer and the client must change the declaration to invalid.

Error-ordered proposal

  1. Is the format three strict paragraphs.
  2. Can you decode JSON?
  3. exp/nbf/iat And the clock (time horizon).
  4. iss/aud/sub/Role (declaration level).
  5. Signing and algorithms (ciphery level).
  6. Finally, business interfaces and front-end state management.

Most of the "input" is undefined on the first three levels, without first questioning the full-scope access model.

6. Real work scene

Scenario A: Accelerator 401

Remove Bearer Token from failed requests, post the decoding device. (a) To update or re-enter the registry if it has expired; If not expired, contrast audThe following is a list of the most popular sites in the world: After decoded. exp Local time to write in the worksheet is more efficient than simply saying "Token is in trouble".

Scene B: End and end of the word "play"

Decoding Payload, confirm that the character field name is role Or is it? roles, whether a string or an array. Align with the same Token in the JSON view, avoiding verbal descriptions of structures in the chat. Payload as necessary JSON Format Two more Diff samples.

C: Suspected Token modified by an intermediary (HTTPS still required)

Signing with known HS256 keys in a controlled environment: Aligning the key with the description; Could not close temporary folder: %s Note: Paste in browser Production Primary Key There is a mobility risk, with priority given to testing keys or only local credible machines, to use clean-up input frames.

Scenario D: Migration algorithm (HS256 → RS256)

Uncode the line to confirm the truth. alg, re-engineer the gateway and the issue configuration. The common "old Token" for migration window periods is still HS256, the new service only RS256. Decoding allows for a distinction, avoiding simply looking at documents without looking at examples.

scene E: long moving end / small application storage Token

Take the full string from the log or debugging bridge (note that the log is dissensitized). If the parse fails, check if it is re-processed by URL code and stored in line-relaying UserDefaults. Decoding first to verify integrity, then checking the storage layer.

Scene F: Teaching and Code Review

- With a fake. Test TokenThe first video of the event, "The change of Payload will fail without changing the signature." Compare Header when Review issues code alg Whether to code hard, deny it alg: none The hazard configuration (service end-checking logic, code decoders only for observation).

7. Security list: all decoded before and after

  • Default Assumptions Payload Anyone can read it.； Prohibit writing passwords, complete payment information, long-term keys
  • Production Token Try not to enter chat groups or open them Worksheets are de-sensitive or tested for account number
  • Public computers empty input frames and clipboard
  • Signing key as confidential: Do not submit to front-end repository, do not write in guideshot
  • The transmission shall be HTTPS; Decoding tool is not a substitute for transfer layer security
  • Short expired + refreshing token; The only way to save a long exp is to magnify the leak window.
  • The service must be signed and verified exp/iss/aud； Debug the front-end decode only
  • Rejected Header. alg: none Or algorithms to confuse attack (service repository configuration)
  • Clock Synchronization: Time deviation between container and host can lead to "incidental lapses"

9. Borders with "entry structure "

The decoded guidelines address the Observation and SequenceNot to design your full authentication. When you land, you suggest that the team agree:

  • The example of Token in the document is forged and the algorithm and the expired strategy is specified.
  • The list of the countries that have been listed for the period is one step further: "Code up before Issue at 401."
  • Keys and public keys are recorded; It's in the decodor. kid(if any) corresponds to the key version.
  • Frontend decoded to display user nickname type statements, but The authorization decision must be at the service end Redo.
  • The security system has distinguished between "signed failed" "undated" "declarations" and "not in line" rejections, avoiding a single and uncheckable 401 signature.

After turning "readable to be" into a habit, the issue of identity has changed from a genre to a field and a time stamp that can be proved.

FAQ

Decoding JWT. Need a key?

No need. Header with Payload is just Base64URL coded, and the decoding device will show. Key for Authentication of SignatureThe same thing is not true with "read the statement" (and encryption JWT, if used).

Why did I change the user ID, interface or old user from Payload?

Because the legitimate service will check. You changed the first two paragraphs without producing a matching signature and the request should be rejected; If it works, it means the service. No correct checkThat was a serious security flaw, not a problem with decodors.

HS256 and RS256. How do you choose? What's the difference when you decode it?

HS256 with shared keys; RS256 Private key sign. Public key test. Decode the content to read the same; The tool for this station Check-in input currently facing HS256。 RS256 is still available to decodify expired and declared statements, and please use the public key and corresponding library for the signing.

Is it a sec or a millisecond from Token?

JWT registration statements usually have time in the sec。 If you take seconds as milliseconds, the date is wrong. is based on the local time comment given by the decoding device and compared to the server time.

Is the online decoding safe? Will you upload me, Token?

Thousands of JWT decoding machines are used to decipher the browser locally, which is not the basis for the random adhesion of the production of high-authority tokens to an untrustworthy environment. Public machines, screen sharing, video presentations are replaced with tests token and clean up the input after completion.

Is a string of two or four paragraphs JWT?

Standard compact sequence is three paragraphs. Two paragraphs may be missing in other formats or reproduction; More paragraphs are also not in line with the expectations of the tool. First, complete. header.payload.signature Resolve.

What's next?

Scatter by layer: check whether the gateway is being verified aud, IP binding, whether CCSF/Additional Cookie is needed, whether the refreshing token is expired, and whether the user is disabled. The decoded version only proves what this Token content is, and not what business allows you to do.

Can you hide JWT as a secret?

No, I can't. Secrets are required to be stored encrypted at the service end or using a specific encryption token scheme and to always be compatible with HTTPS. JWT Default Decodable Declaration + Optional Signature。

Continue reading

Take one first. Test Environment Token uses the tool to "paint and click and check" and then check the error sheet to process the real 401. You can also return a list of guides or a directory of tools to continue browseing.

Open JWT decoding device Back Guide List All tools