TOKEN INSPECTION GUIDE · 7 MIN READ

What a JWT decoder can—and cannot—tell you

A JSON Web Token often contains readable Base64URL-encoded JSON. Decoding reveals claims for debugging, but it does not prove that the token was issued by a trusted party or that its signature is valid.

Read the three parts

A compact JWT normally contains header, payload and signature segments separated by dots. The header names the algorithm; the payload carries claims; the signature protects integrity when verified correctly.

Treat claims as untrusted until verification

Anyone can construct a header and payload. A trusted application must validate the signature with the expected algorithm and key, then check issuer, audience, expiry and any application-specific rules.

Avoid exposing real tokens

Tokens can grant access even when their payload looks harmless. Use redacted samples for debugging, keep production tokens out of general tools and rotate a credential that may have leaked.

Worked example

An exp claim is a Unix timestamp. Decode it for inspection, then convert the value to a readable date; expiry still matters only after signature verification.

Limitations to review

• The focused decoder does not verify signatures.
• Decoding does not contact an issuer.
• A readable token can still be sensitive.