AkousaJWT Inspektor
Dekodiert und untersucht JSON-Web-Token-Header, Payloads und Signaturen.
Über JWT Inspector
Der JWT-Inspektor decodes JSON Web Tokens (RFC 7519) by Base64url-decoding the header, payload, and signature segments and presenting them in a structured, color-coded view with all standard claim names labeled — including iss (issuer), sub (subject), aud (audience), exp (expiration), iat (issued at), nbf (not before), and jti (JWT ID). It automatically detects the signing algorithm from the alg header, displays the expiration status with a human-readable countdown, and flags security-sensitive conditions like the alg: none attack vector. All decoding happens in your browser — the token never leaves your device.
So verwenden Sie es
Fügen Sie a JWT token — the three Base64url-encoded segments separated by dots — into the input field. The header section shows the algorithm, key ID, and token type. The payload section lists all claims with their decoded values and human-readable timestamps for exp, iat, and nbf. The signature section shows the raw Base64url signature bytes and the algorithm used. The expiry indicator shows whether the token is currently valid, expired, or not-yet-valid based on the exp and nbf claims relative to the current UTC time.
Häufige Anwendungsfälle
- Backend-Entwickler debugging authentication failures by decoding JWT access tokens from Authorization headers to verify that the exp, iss, aud, and custom role claims contain the expected values for the failing request
- Sicherheitsingenieure auditing OAuth 2.0 and OpenID Connect implementations by inspecting id_token and access_token payloads to verify correct issuer, audience restriction, and signature algorithm
- Frontend-Entwickler examining identity provider tokens from Auth0, Cognito, Firebase Auth, or Azure AD B2C to understand which claims are available in the token for access control logic
- Penetrationstester, die JWTs aus erfasstem HTTP-Datenverkehr analysieren, um schwache Signaturalgorithmen, fehlende Audience-Claims, lange Ablaufzeiträume oder sensible Daten in unverschlüsselten Payload-Claims zu identifizieren
- DevOps-Ingenieure and platform teams quickly checking the expiration time and issuer of service account tokens, Kubernetes service account JWTs, or API gateway tokens during incident diagnosis without writing a decode script