How to Inspect a JWT Without Uploading It
Decode JWT claims locally, check expiration and issuer details, and understand why decoding is not the same as signature verification.
Treat a JWT like a credential
A JSON Web Token often contains readable metadata, but it may also grant access to an API. Copying a live token into an unknown server-side decoder can expose the bearer credential even when the page only appears to show its claims.
A safer inspection path keeps the compact token inside the current browser tab. Local decoding is enough to read the header and payload because those segments use Base64URL encoding, not encryption.
- Prefer a test token when one is available.
- Never post the original compact token in tickets or chat.
- Rotate a production token if it has crossed an untrusted boundary.
Decode the structure before debugging claims
A JWT normally has three dot-separated segments: header, payload and signature. Decode the first two segments, parse them as JSON and check that the algorithm and token type match what the application expects.
Then inspect registered claims such as iss, aud, sub, exp, nbf and iat. Expiration failures are frequently caused by clock skew, mixed seconds and milliseconds, or a token issued for a different audience.
- Check that exp and iat are numeric date values in seconds.
- Compare iss and aud against the API configuration.
- Review custom roles or scopes for unexpected privilege changes.
Decoding does not prove authenticity
Anyone can construct a header and payload. A decoder can explain what a token claims, but only signature verification can show whether a trusted issuer signed those exact bytes.
For HS256 development tokens, verify with the expected shared secret in a local lab. For RS256, ES256 and production identity providers, use the issuer's supported backend library and published key set. Also enforce the expected algorithm instead of trusting the alg value inside the token.
Use a repeatable local workflow
Start with JWT Decoder to inspect the structure and readable dates. Move to JWT Lab only when an HS256 signature check is appropriate, and use Timestamp Converter for deeper date comparisons.
Before sharing any diagnostic output, remove the original compact token and scan the remaining text for other credentials. A useful ticket contains the failing claim values and timestamps, not a reusable bearer token.
Apply this workflow locally
Start with JWT Decoder, keep the original input private and inspect the result before sharing or using it downstream.
Open JWT Decoder →