Codifica
JWT Encoder/Decoder
Codifica e decodifica di token JWT — header, payload, firma HMAC e campi standard.
Gli esempi firmati (tutti tranne none) richiedono HTTPS — la pagina è attualmente aperta senza HTTPS.
Per RS/PS/ES la chiave viene generata automaticamente e temporaneamente — solo a scopo dimostrativo, non riutilizzabile.
Gli esempi firmati (tutti tranne none) richiedono HTTPS — la pagina è attualmente aperta senza HTTPS.
Claims
Domande frequenti
Does decoding a JWT verify its signature?
No. Decoding just base64url-decodes the header and payload so you can read the claims — it does not prove the token is authentic. To actually verify a signature you need the correct secret or public key entered here.
Is it safe to paste a real JWT into this tool?
Decoding and signing happen entirely in your browser — the token and any secret you enter are never sent to a server. Still, treat tokens from production systems carefully, since anyone who sees a decoded JWT can read its claims.
Why does my token show as expired even though it still works in my app?
The Expired/Valid indicator here only compares the exp claim to the current time — it doesn't check clock skew tolerances or other validation rules your server or library might apply.