🔧

Decodificador de JWT

Codificación y Cifrado · Herramienta online gratuita

Decodificar tokens JWT e inspeccionar encabezado y payload.

Equipo CoderNewbieÚltima actualización: 2026-09-20

JWT Token176 caracteres

Estructura de tres partes

Un JWT es encabezado.payload.firma, cada uno codificado en base64url. Esta herramienta separa y decodifica los tres.

Claims de tiempo

Los claims estándar exp, iat y nbf se muestran como fechas legibles con su estado de validez.

Solo decodificación

Esta herramienta decodifica y muestra el token — no verifica la firma. Nunca confíes en los claims sin verificar primero.

Cómo usar Decodificador de JWT

1Enter or paste your data into the input field.
2Select the desired encoding, hashing, or encryption options.
3Click the action button to process your data.
4Copy the result from the output field.

Características

✓100% gratis — sin registro, sin suscripción, sin anuncios
✓Funciona íntegramente en tu navegador — los datos nunca salen de tu dispositivo
✓Rápida y ligera — resultados instantáneos
✓Multiplataforma — funciona en escritorio, tableta y móvil

¿Qué es Decodificador de JWT?

JSON Web Token (JWT), defined by RFC 7519, is a compact, URL-safe token format for securely transmitting claims between parties. A JWT consists of three Base64URL-encoded parts separated by dots: Header.Payload.Signature. It is widely used for API authentication, OAuth 2.0, and SSO.

¿Cómo funciona Decodificador de JWT?

The Header specifies the signing algorithm (e.g., HS256, RS256). The Payload contains claims (registered, public, private) — statements about an entity. The Signature is computed over the encoded Header and Payload using the algorithm and a secret/private key. To verify, recompute the signature and compare.

Casos de uso habituales

✓API authentication — bearer tokens in Authorization headers
✓OAuth 2.0 — access tokens and ID tokens
✓SSO — share identity across multiple services
✓Stateless sessions — store user info without server-side sessions

JWT vs Session Cookies

Sessions store state server-side; JWTs are stateless and self-contained. JWTs scale better (no session store) but are harder to revoke before expiry. Sessions are more secure for sensitive apps (can revoke instantly); JWTs suit distributed/microservice architectures. Always use HTTPS for both.

Seguridad y privacidad

This tool decodes JWTs locally in your browser — your token never leaves your device. IMPORTANT: Decoding a JWT only reads its contents; it does NOT verify the signature. Never trust JWT claims without server-side signature verification. JWTs are visible to anyone who intercepts them — use HTTPS.

Detalles técnicos

Standard: RFC 7519. Structure: Base64URL(Header).Base64URL(Payload).Base64URL(Signature). Header: alg (HS256/RS256/ES256/none), typ. Registered claims: iss (issuer), sub (subject), aud (audience), exp (expiry), nbf (not before), iat (issued at), jti (JWT ID). Signature: HMAC(SHA-256) for HS256, RSA for RS256. 'alg: none' tokens must always be rejected.

Preguntas frecuentes

Is decoding a JWT the same as verifying it?

No. Decoding reads the payload; verification checks the signature cryptographically. Anyone can decode a JWT; only the server with the secret can verify it. Never trust unverified JWT claims.

What is the 'alg: none' vulnerability?

If a server accepts 'alg: none' tokens, attackers can forge tokens without a signature. Always reject 'none' algorithm and use a hardcoded allowed-algorithms list.

How long should a JWT live?

Access tokens: 15-60 minutes. Refresh tokens: days to weeks. Short-lived access tokens limit damage if leaked. Use refresh tokens to maintain sessions.