Decoder JWT

Decode header, payload, dan signature JWT (JSON Web Token) secara instan. Lihat status klaim exp, iat, nbf. 100% sisi klien, tanpa unggahan, tanpa pelacakan.

Dekode JWT tanpa mengunggah token Anda

Instant JWT decoding with claim status indicators and pretty-printed JSON — right in your browser. No uploads, no sign-up, no limits.

100% pribadi

Instant decoding

Gratis selamanya

Cara menggunakan

1
Tempel JWT Anda
Salin JWT dan tempel ke kotak input di bagian atas.
2
Tinjau Header & Payload
Header (algoritma) dan payload (klaim) yang didekode muncul sebagai JSON yang dicetak cantik.
3
Periksa Status Klaim
Klaim iat, nbf, dan exp disorot — token yang kedaluwarsa atau belum valid ditandai dengan merah atau kuning.
4
Salin Jika Diperlukan
Gunakan tombol Salin untuk menyalin header atau payload JSON yang didekode.

Mengapa Menggunakan Decoder JWT Ini?

Dekoding Lokal Instan

Header dan payload didekode dan dicetak cantik sebagai JSON saat Anda menempelkan token — tanpa tombol untuk diklik.

Indikator Status Klaim

Klaim `exp`, `nbf`, dan `iat` diurai dan dibandingkan dengan waktu saat ini, dengan status berwarna jelas untuk token yang kedaluwarsa, belum valid, dan aktif.

Aman UTF-8

Mendekode dengan benar payload Base64URL yang berisi karakter non-ASCII, termasuk emoji dan teks internasional.

Understanding JSON Web Tokens (JWT)

What is a JWT?

A JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. JWTs are commonly used for authentication and authorization in web applications. After a user logs in, the server issues a JWT containing claims about the user (such as their user ID and roles). The client includes this JWT in the Authorization header of subsequent requests, allowing the server to verify the user's identity without storing session state.

A JWT consists of three parts separated by dots: `header.payload.signature`. The header specifies the token type (JWT) and the signing algorithm (e.g., HS256, RS256). The payload contains the claims — statements about the user and additional metadata. The signature is used to verify that the token hasn't been tampered with. Only the header and payload are Base64URL-decoded to read the claims; the signature is a binary value used only for verification.

Decoding vs. verifying a JWT

Decoding a JWT means Base64URL-decoding the header and payload to read the claims. This does not require any secret key — anyone can decode a JWT. Decoding tells you what the token claims, but it does not prove that the claims are true or that the token was issued by a trusted party.

Verifying a JWT means checking the signature using the secret key (for HMAC algorithms) or public key (for RSA/ECDSA algorithms). This confirms that the token was issued by the holder of the secret/private key and that it hasn't been modified since. Only verified tokens should be trusted for security decisions. Our tool decodes JWTs but does not verify them — for verification, use a library like jsonwebtoken (Node.js) or PyJWT (Python).

Common JWT claims

Registered claims (defined in RFC 7519): `sub` (subject — the user ID), `iss` (issuer), `aud` (audience), `exp` (expiration time), `nbf` (not before), `iat` (issued at), `jti` (JWT ID). Private claims: custom claims agreed upon by the parties, such as `role`, `permissions`, `email`, or `name`. Our tool displays all claims in the payload as formatted JSON.

Kasus Penggunaan Umum

Debugging Otentikasi

Periksa klaim JWT yang dikeluarkan oleh server otentikasi Anda untuk mengonfirmasi ID pengguna, peran, atau kedaluwarsa.

Pengembangan API

Verifikasi dengan cepat bahwa JWT yang Anda hasilkan di server berisi payload yang diharapkan sebelum mengirimnya ke klien.

Mempelajari Struktur JWT

Lihat persis bagaimana JWT disusun — header, payload, signature — tanpa menulis kode apa pun.

Pemecahan Masalah Token Kedaluwarsa

Lihat secara instan apakah kesalahan 401 disebabkan oleh klaim `exp` yang kedaluwarsa atau klaim `nbf` yang belum valid.

Bagaimana ini dibandingkan dengan dekoder JWT lain?

A side-by-side comparison of popular JWT decoding tools.

Fitur	NovaTools	JWT.io	JWT.ms
Privasi (tanpa unggah)	100% lokal	Unggah ke server	Unggah ke server
Harga	Gratis tanpa batas	Gratis dengan iklan	Free
Status claim (exp/nbf/iat)	Color-coded
Pretty-printed JSON
UTF-8 safe decoding			Terbatas
Ramah mobile		Terbatas	Terbatas
Berfungsi offline	Setelah halaman dimuat

JWT.io and JWT.ms upload your token to their servers for decoding. Our tool decodes everything locally — your JWT never leaves your browser.

JWT Quick Reference

Key facts about JSON Web Tokens.

Token Structure

Simbol / Kode	Deskripsi	Contoh
`header.payload.signature`	Three Base64URL-encoded parts separated by dots.	`eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abc123`
`header`	JSON object with algorithm (alg) and token type (typ).	`{"alg":"HS256","typ":"JWT"}`
`payload`	JSON object with claims about the user and token.	`{"sub":"123","exp":1735689600}`
`signature`	HMAC/RSA/ECDSA signature. Not decoded, only verified.	`HMAC-SHA256(header.payload, secret)`

header.payload.signature

Three Base64URL-encoded parts separated by dots.

Contoh:eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abc123

header

JSON object with algorithm (alg) and token type (typ).

Contoh:{"alg":"HS256","typ":"JWT"}

payload

JSON object with claims about the user and token.

Contoh:{"sub":"123","exp":1735689600}

signature

HMAC/RSA/ECDSA signature. Not decoded, only verified.

Contoh:HMAC-SHA256(header.payload, secret)

Registered Claims

Simbol / Kode	Deskripsi	Contoh
`sub`	Subjek — mengidentifikasi pengguna atau entitas.	`"sub":"user-123"`
`iss`	Penerbit — mengidentifikasi siapa yang menerbitkan token.	`"iss":"auth.example.com"`
`aud`	Audiens — penerima yang dituju dari token.	`"aud":"api.example.com"`
`exp`	Expiration time (Unix timestamp in seconds).	`"exp":1735689600`
`iat`	Issued at (Unix timestamp in seconds).	`"iat":1735603200`
`nbf`	Not before — token is not valid before this time.	`"nbf":1735603200`

sub

Subjek — mengidentifikasi pengguna atau entitas.

Contoh:"sub":"user-123"

iss

Penerbit — mengidentifikasi siapa yang menerbitkan token.

Contoh:"iss":"auth.example.com"

aud

Audiens — penerima yang dituju dari token.

Contoh:"aud":"api.example.com"

exp

Expiration time (Unix timestamp in seconds).

Contoh:"exp":1735689600

iat

Issued at (Unix timestamp in seconds).

Contoh:"iat":1735603200

nbf

Not before — token is not valid before this time.

Contoh:"nbf":1735603200

Algorithms

Simbol / Kode	Deskripsi	Contoh
`HS256`	HMAC with SHA-256. Symmetric — same secret for sign and verify.	`{"alg":"HS256"} + shared secret`
`RS256`	RSA signature with SHA-256. Asymmetric — private key signs, public key verifies.	`{"alg":"RS256"} + RSA 2048-bit key pair`
`ES256`	ECDSA with P-256 and SHA-256. Asymmetric — smaller signatures than RSA.	`{"alg":"ES256"} + EC P-256 key pair`
`none`	Tanpa tanda tangan. TIDAK AMAN — jangan pernah gunakan di produksi.	`{"alg":"none"} — CRITICAL vulnerability`

HS256

HMAC with SHA-256. Symmetric — same secret for sign and verify.

Contoh:{"alg":"HS256"} + shared secret

RS256

RSA signature with SHA-256. Asymmetric — private key signs, public key verifies.

Contoh:{"alg":"RS256"} + RSA 2048-bit key pair

ES256

ECDSA with P-256 and SHA-256. Asymmetric — smaller signatures than RSA.

Contoh:{"alg":"ES256"} + EC P-256 key pair

none

Tanpa tanda tangan. TIDAK AMAN — jangan pernah gunakan di produksi.

Contoh:{"alg":"none"} — CRITICAL vulnerability

Pertanyaan yang sering diajukan

Apakah alat ini memverifikasi signature JWT?

Tidak. Alat ini hanya mendekode token — alat ini tidak memverifikasi signature. Dekoding memberi tahu Anda apa yang diklaim token, tetapi siapa pun dapat membuat token dengan klaim apa pun. Verifikasi memerlukan secret penandatanganan atau kunci publik.

Apakah aman menempelkan JWT saya di sini?

Ya. Semua dekoding terjadi secara lokal di browser Anda. Token tidak pernah dikirim ke server. Namun, Anda masih harus menghindari menempelkan token ke situs yang tidak tepercaya, dan jangan pernah membagikan JWT dalam tangkapan layar atau tiket dukungan.

Apa arti klaim iat, nbf, dan exp?

`iat` (issued at) adalah kapan token dibuat. `nbf` (not before) adalah waktu paling awal token valid. `exp` (expiration) adalah kapan token berhenti valid. Semua disimpan sebagai timestamp Unix dalam detik.

Mengapa token saya memiliki tiga bagian?

JWT memiliki tiga bagian yang dikodekan Base64URL yang dipisahkan oleh titik: `header.payload.signature`. Header menjelaskan algoritma, payload berisi klaim, dan signature digunakan untuk memverifikasi integritas.

Apa itu pengkodean Base64URL?

Base64URL adalah varian Base64 yang menggunakan `-` alih-alih `+` dan `_` alih-alih `/`, serta menghilangkan padding `=`. Ini membuat string yang dikodekan aman digunakan dalam URL dan JSON.

Apakah alat ini memverifikasi tanda tangan JWT?

No. This tool only decodes the token — it does not verify the signature. Decoding tells you what the token claims, but anyone can create a token with any claims. Verification requires the signing secret (for HMAC algorithms like HS256) or the public key (for RSA algorithms like RS256, or ECDSA algorithms like ES256). Never trust a JWT's claims for security decisions without verifying its signature first. If you need to verify a JWT, use a library like jsonwebtoken (Node.js), PyJWT (Python), or jose (JavaScript/TypeScript) with the correct secret or key.

Apakah aman menempelkan JWT saya di sini?

Yes. All decoding happens locally in your browser using JavaScript. The token is never sent to a server, never stored, and never logged. You can verify this by opening your browser's DevTools Network tab — no network requests are made when you paste or decode a token. However, you should still avoid pasting tokens into untrusted sites, and never share JWTs in screenshots, support tickets, or public channels. Even though our tool is safe, other online JWT decoders may upload your token to their server.

Apa arti klaim iat, nbf, dan exp?

These are registered claims defined in RFC 7519 that control the token's temporal validity. `iat` (issued at) is a Unix timestamp indicating when the token was created. `nbf` (not before) is a Unix timestamp indicating the earliest time the token is considered valid — before this time, the token should be rejected. `exp` (expiration) is a Unix timestamp indicating when the token expires — after this time, the token should be rejected. All three are stored as seconds since the Unix epoch (January 1, 1970, 00:00:00 UTC). Our tool parses these claims and shows a color-coded status: green for active, yellow for not-yet-valid, and red for expired.

Mengapa token saya memiliki tiga bagian?

A JWT consists of three Base64URL-encoded parts separated by dots: `header.payload.signature`. The header describes the token type (JWT) and the signing algorithm (e.g., HS256, RS256). The payload contains the claims — statements about an entity (typically the user) and additional metadata. The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message wasn't changed along the way. To decode a JWT, you only need to Base64URL-decode the header and payload — the signature is not decoded, it's a binary value used only for verification.

Apa itu encoding Base64URL dan bagaimana berbeda dari Base64?

Base64URL is a variant of Base64 designed to be safe for use in URLs and filenames. It replaces the `+` character with `-` and the `/` character with `_`, and it omits the `=` padding character at the end. This is necessary because `+` and `/` have special meanings in URLs (they represent spaces and path separators, respectively). JWT uses Base64URL for encoding the header, payload, and signature. If you try to decode a JWT part with standard Base64, you may get an error because `-` and `_` are not valid standard Base64 characters.

Apa saja klaim JWT yang paling umum?

The most common registered claims are: `sub` (subject — the user ID), `iss` (issuer — who issued the token), `aud` (audience — who the token is intended for), `exp` (expiration time), `nbf` (not before), `iat` (issued at), and `jti` (JWT ID — a unique identifier for the token). Custom claims can also be included, such as `role`, `permissions`, `email`, or `name`. Our tool displays all claims in the payload as a formatted JSON object.

Bisakah saya mendekode JWT tanpa kunci rahasia?

Yes. Decoding a JWT does not require the secret key — you only need to Base64URL-decode the header and payload. The secret key is only required for verifying the signature, which confirms that the token was issued by a trusted party and hasn't been tampered with. This is a common source of confusion: decoding is not the same as verifying. Anyone can decode a JWT, but only someone with the secret key can verify it.

Apa yang terjadi jika saya menempelkan JWT yang tidak valid?

The tool will display an error message indicating what went wrong. Common errors include: not having exactly three dot-separated parts, containing characters that are not valid Base64URL, or having a payload that is not valid JSON after decoding. The error message will tell you exactly what is wrong so you can fix the input.

Apakah alat ini berfungsi di perangkat seluler?

Ya. Alat ini sepenuhnya responsif dan berfungsi di iOS Safari dan Android Chrome. Mode AI memerlukan perangkat yang relatif kuat — ponsel kelas menengah dari 2-3 tahun terakhir menanganinya dengan baik, tetapi perangkat lama mungkin lambat atau kehabisan memori. Mode Color Key berfungsi di semua perangkat, termasuk ponsel lama. Di seluler, Anda dapat memilih gambar dari pustaka foto, kamera, atau aplikasi penyimpanan cloud.

Bisakah saya menggunakan alat ini untuk proyek komersial?

Ya. Alat ini gratis untuk penggunaan pribadi dan komersial tanpa watermark, tanpa atribusi yang diperlukan, dan tanpa batasan penggunaan. Anda mempertahankan kepemilikan penuh atas gambar yang diproses. Model AI yang mendasari (MediaPipe) dilisensikan oleh Google untuk penggunaan komersial. Tidak ada pendaftaran, tidak ada API key, dan tidak ada langganan yang diperlukan.

Privasi Anda Adalah Prioritas Kami

Alat ini berjalan sepenuhnya di browser Anda. File Anda tidak diunggah ke server, tidak disimpan, dan tidak dianalisis.

Kami tidak mengunggah, menyimpan, atau menganalisis file Anda.
Semua yang Anda proses tetap di perangkat Anda.
Tidak ada pemrosesan sisi server, penyimpanan cloud, atau analisis.

Bahkan jika koneksi internet Anda terputus, file Anda tetap aman.

Anda mungkin juga suka

Jelajahi topik ini

Semua alat dalam kategori iniAlat Kode & Data Panduan untuk topik iniAlat developer

Alat Kode Batang & QR

Hasilkan dan pindai semua format kode batang dan kode QR umum.

Pemformat JSON

Perindah dan validasi data JSON.

Encoder/Decoder Base64

Encode dan decode teks Base64, termasuk string aman untuk URL.