JWT Decoder: Decode a Token and Check Claims — Practical Guide
jwt decoder: Decode a JWT to inspect its header and claims, and understand why decoding alone does not verify the token signature. Read the steps and example.
A JSON Web Token is often three Base64url-encoded parts separated by dots: a header, a payload, and a signature. Decoding can help inspect claims such as issuer or expiration, but it does not prove that the token is authentic. Anyone can create a token-like string with arbitrary claims. Do not paste production credentials into an untrusted website. Verify signatures and claims on a trusted server using the issuer’s expected algorithm and keys.
Separate the token segments
Split the compact token at its periods and inspect the first two segments as Base64url data. Base64url uses a URL-safe alphabet and may omit padding. The header describes the signing algorithm and key identifier; the payload contains claims. Treat both as untrusted input until a signature is verified. A malformed token may have an unexpected number of parts or invalid encoding, so report parsing errors rather than guessing.
Check standard claims with context
The exp claim is a NumericDate in seconds since the Unix epoch; nbf and iat also use time-based values. Compare them with the current time and allow for an explicitly chosen clock-skew policy. The iss, aud, and sub claims have meaning only in the application’s trust model. A token can decode cleanly and still be expired, intended for a different audience, or forged.
Verify before granting access
A secure application checks the signature using a trusted key and approved algorithm, then validates issuer, audience, expiration, and any application-specific permissions. Do not choose a verification algorithm solely because the untrusted header requests it. Avoid logging full tokens because they can act as bearer credentials. If a token was accidentally exposed, follow the issuer’s revocation or rotation process.
Worked example
header.payload.signature
Decode header and payload to inspect claims.
Then verify the signature and claims on a trusted server before authorization.Does decoding a JWT prove it is valid?
No. Decoding reveals encoded contents only. Validity requires signature verification and claim checks against a trusted issuer.
Reference and further reading
KEEP EXPLORING
Another useful idea.
Subresource Integrity Guide: Generate SRI for Scripts and CSS
Add integrity hashes to external scripts and stylesheets and understand exact bytes, CORS, and version pinning.
How to Fix an SRI Hash Mismatch in the Browser
Diagnose integrity failures caused by changed files, line endings, CDN transformations, redirects, and CORS.
HTTP Basic Authentication: Header Format and Limitations
Generate and decode Basic Authorization headers and understand usernames, passwords, UTF-8, and HTTPS.