RFC 7519 표준 및 HMAC 검증6 분 소요최종 업데이트:
JWT 토큰 구조와 서명 검증: RFC 7519 표준 기술 심층 가이드
JWT의 헤더와 페이로드를 로컬에서 디코딩하고 HMAC-SHA256 서명을 검증하여 토큰 만료를 안전하게 확인합니다.
W
WEBioDD 엔지니어링 팀•100% 브라우저 로컬 실행 & 제로 트러스트
핵심 요약
- JWT는 점(.)으로 구분된 3개의 Base64URL 요소(헤더, 페이로드, 서명)로 구성됩니다.
- 서명은 무결성을 보장하지만 암호화하지 않으므로 페이로드 내용은 누구나 확인할 수 있습니다.
- 재전송 공격을 방지하기 위해 exp(만료시간) 및 nbf(활성시간) 클레임을 반드시 검증하세요.
- 프로덕션 환경의 비밀 키와 토큰을 검증되지 않은 외부 클라우드 도구에 붙여넣지 마세요.
100% In-Browser & Local Execution
JWT 토큰 디코딩 및 디버깅하기
비밀 키를 외부 네트워크로 전송하지 않고 브라우저에서 안전하게 헤더, 페이로드, 서명을 분석합니다.
- RFC 7519 compliant parser
- HMAC-SHA256 signature verify
- Live expiration countdown
- 100% client-side execution
01.JWT Token Anatomy: Header, Payload, and Signature
A JSON Web Token (JWT) is a compact, URL-safe string divided into three Base64URL-encoded segments: Header.Payload.Signature. The Header declares the signing algorithm (e.g., HS256 for HMAC-SHA256). The Payload contains claims (user ID, roles, expiration). The Signature is computed by hashing the encoded header and payload with a secret key, ensuring the token has not been tampered with.
typescriptClient-side JWT parsing without server transmission
// JWT Decoding Algorithm
function decodeJWT(token: string) {
const [headerB64, payloadB64, signatureB64] = token.split('.');
const header = JSON.parse(atob(headerB64.replace(/-/g, '+').replace(/_/g, '/')));
const payload = JSON.parse(atob(payloadB64.replace(/-/g, '+').replace(/_/g, '/')));
return { header, payload, signature: signatureB64 };
}02.HMAC-SHA256 Signature Verification Process
To verify a JWT signature locally, concatenate the Base64URL-encoded header and payload with a dot, then compute HMAC-SHA256 using your secret key via Web Crypto API. Compare the result against the provided signature. A mismatch indicates tampering or an incorrect secret.
Never paste production secret keys into online JWT debuggers. Our tool runs 100% locally in your browser memory.
03.Token Expiration & Timestamp Claims
The exp claim (expiration time) is a Unix timestamp defining when the token becomes invalid. The nbf (not-before) claim prevents premature token usage. Always validate these claims on the server and display countdown timers to users in dashboards.
Local JWT Debugger vs. Remote Online Validators
Technical architectural comparison between local browser execution and cloud server processing.
| Security Aspect | Local Browser Tool | Third-Party JWT.io Sites |
|---|---|---|
| Secret Key Exposure | Never leaves browser memory | Transmitted over HTTPS POST |
| Token Payload Privacy | Decoded in local RAM only | Sent to remote servers & logged |
| Validation Latency | Instant (sub-millisecond) | 150ms - 500ms network delay |
| Offline Capability | Works without internet | Fails when disconnected |
How to Decode and Verify JWT Tokens
Step-by-step instructions for JWT inspection and validation.
1
Paste JWT Token
Copy your JWT string from API responses or browser cookies and paste into the debugger input field.
2
Inspect Header & Payload
View decoded JSON claims including user ID, roles, issued-at (iat), and expiration (exp) timestamps.
3
Verify Signature (Optional)
Enter your secret key to validate HMAC signature integrity (never use production keys on public tools).
4
Check Expiration Status
Review the live countdown timer showing time remaining until token expiry.
JWT Security Best Practices
- ✓Always use HTTPS to prevent JWT interception during transmission.
- ✓Set short expiration times (15-60 minutes) and refresh tokens via secure endpoints.
- ✓Never store sensitive data in JWT payloads; they are NOT encrypted.
- ✓Validate signatures and expiration timestamps on every API request server-side.
Frequently Asked Questions
No. JWT payloads are Base64URL-encoded, which is easily decoded. Never store passwords or PII in JWT claims.