مركز المعرفة والمفاهيم
أداة فك تشفير وفحص رموز JSON Web Token (JWT)
أداة فك تشفير وفحص رموز JSON Web Token (JWT)
تعمل هذه الأداة محلياً بالكامل داخل المتصفح (Client-Side). لا يتم إرسال أكوادك أو بياناتك الحساسة إلى أي خادم خارجي.
البنية الأساسية والصيغة الرياضية
JWT Structure = Base64Url(Header) . Base64Url(Payload) . Signature
The Token consists of three distinct parts separated by dots. The Header defines the algorithm (e.g., HS256), the Payload contains the user claims, and the Signature cryptographically validates the data.
أفضل الممارسات والإرشادات الأساسية
- Never Store Secrets in the Payload: The JWT payload is merely Base64 encoded, not encrypted. Anyone can decode it. Never store passwords, social security numbers, or API keys inside the token payload.
- Enforce Short Expirations (EXP): Stateless JWTs cannot be easily revoked once issued. Always set the 'exp' claim to 15 or 30 minutes, and use secure HttpOnly refresh tokens to issue new ones.
- Validate the Signature on the Server: Decoding the payload on the frontend is fine for UI logic, but your backend API must cryptographically verify the signature using your secret key before trusting any data.
الأسئلة الشائعة (FAQ)
Why is the JWT signature important?
The signature is generated using a secret key known only to your server. If a hacker manipulates the decoded payload (e.g., changing their role to 'admin'), the server will reject it because the signature will no longer match the altered data.
Can I decode a JWT without the secret key?
Yes. The Header and Payload are just Base64Url encoded strings. Anyone can decode and read them. You only need the secret key to verify the signature or to generate a new valid token.
What is the 'sub' claim?
The 'sub' (Subject) is a reserved standard claim intended to uniquely identify the user (usually a database User ID or UUID) that the token authenticates.