Decode JWT

Показать описание

00:00 How to decode a JWT
01:05 Decoding a JWT in the command line
01:50 you will rarely need to base64-decode parts of a token by yourself

The individual parts of a JWT are base-64 url encoded. This is true for both the JSON Web Signature and the JSON Web Encryption token. Now before you can do anything with this token, you first need to decode the individual parts. Typically the library that you are using will take care of this for you. You will rarely have to bse64-url decode a token by yourself. All modern frameworks and programming languages like Spring, Spring Boot, Python, C# and so on offer libraries that can handle JWTs out of the box. For security reasons, it is recommended that you make use of these libraries and that you do not attempt to implement your own JWT logic.

When it comes to JSON Web Signature token, the content is just signed and not encrypted. This means that decoding the header and the claim set will give you the original data in plaintext. JSON Web Signature tokens only guarantee that you can detect if someone has tampered with the data. However, the data the token is carrying is not opaque because it is only base64-url encoded. To see the original data with JSON Web Encryption Tokens though you need to have the respective private key to see the original data.