Codificação
JWT Encoder/Decoder
Codificação e decodificação de tokens JWT — cabeçalho, payload, assinatura HMAC e campos padrão.
Exemplos assinados (todos exceto none) exigem HTTPS — a página está aberta sem HTTPS no momento.
Para RS/PS/ES, a chave é gerada automática e temporariamente — apenas para demonstração, não pode ser reutilizada.
Exemplos assinados (todos exceto none) exigem HTTPS — a página está aberta sem HTTPS no momento.
Claims
Perguntas frequentes
Does decoding a JWT verify its signature?
No. Decoding just base64url-decodes the header and payload so you can read the claims — it does not prove the token is authentic. To actually verify a signature you need the correct secret or public key entered here.
Is it safe to paste a real JWT into this tool?
Decoding and signing happen entirely in your browser — the token and any secret you enter are never sent to a server. Still, treat tokens from production systems carefully, since anyone who sees a decoded JWT can read its claims.
Why does my token show as expired even though it still works in my app?
The Expired/Valid indicator here only compares the exp claim to the current time — it doesn't check clock skew tolerances or other validation rules your server or library might apply.