JWT Decoding Samajhna
JSON Web Tokens (JWT) compact aur URL-safe tokens hote hain, jinhe applications ke beech authentication aur secure data exchange ke liye use kiya jata hai. Ek JWT mein dots (.) se separated 3 parts hote hain:
Header.Payload.Signature
- Header – Isme token type aur signing algorithm hota hai
- Payload – Isme user ID, issuer, audience aur expiry time jaise claims hote hain
- Signature – Yeh verify karta hai ki token tampering to nahi hui hai
JWT decode karne se developers in values ko inspect karke confirm kar sakte hain ki token valid hai ya nahi.
JWT Token ka Example
Niche JWT ka ek simple example hai:
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNjAwMDAwMDAwLCJleHAiOjE5MDAwMDAwMDB9
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
Decoded Output Header
{
"alg": "HS256",
"typ": "JWT"
}
Yeh dikhata hai ki token HS256 algorithm use karta hai aur ek standard JWT hai.
Decoded Output Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1600000000,
"exp": 1900000000
}
Key Fields ki Explanation:
- sub – Subject ya User Identifier
- name – User ka Display Name
- iat – Token issue hone ka time (Issued At)
- exp – Expiry timestamp, jiske baad token invalid ho jata hai
Signature Verification
JWT ka last part Signature hota hai, jo yeh ensure karta hai ki:
- Token payload ke saath koi tampering nahi ki gayi hai
- Token ek trusted source dwara issue kiya gaya tha
Verification inke dwara hota hai:
- HS256 tokens ke liye ek Shared Secret Key
- RS256 tokens ke liye JWKS endpoint se Public Key
Agar verification fail hota hai, to token par trust nahi kiya jana chahiye.
tools.jwt_decoder.when_jwtdec
Developers usually JWT decode karte hain:
- Login ya authentication issues debug karne ke liye
- Token expiry aur renewal time confirm karne ke liye
- Identity providers se aaye claims ko inspect karne ke liye
- API integration ke time signature validate karne ke liye
Yeh tool bina kisi token ko server par store kiye fast aur secure inspection ki permission deta hai.
Frequently Asked Questions (FAQ)
JSON Web Token (JWT) ek compact string hai jiska use securely information transmit karne ke liye hota hai.
Yeh encoded token ko readable JSON mein convert karta hai taaki aap details dekh sakein aur issues debug kar sakein.
Nahi, decoding bas token ka data content show karti hai.
Verification cryptographic signature check karke confirm karta hai ki token genuine hai ya nahi.
Haan! Decoder token ko kahin store nahi karta. Phir bhi sensitive production tokens share karne se bachein.
Payload mein 'exp' claim check karein.
Agar current time is timestamp se aage nikal gaya hai, to token expired aur invalid hai.
JWKS ek public endpoint hai jo RS256 jaise tokens ko verify karne ke liye public keys provide karta hai.
Common reasons include:
- Galat Secret ya Public Key
- Token issue hone ke baad modify kar diya gaya hai
- Wrong signing algorithm ka selection
- Token already expire ho chuka hai