A JWT can look convincing and still be invalid. Decoding it shows what it contains, which is useful for debugging login problems. Your application still needs to check that it can trust the token.
Use the JWT decoder with a made-up example while learning. Avoid pasting a live access token or sharing one in a screenshot.
Read the three parts
A compact signed JWT usually has three parts separated by periods: a header, a payload and a signature.
The header describes the signing algorithm. The payload contains claims such as the user ID, issuer and expiry time. Both use Base64url encoding, which is readable encoding rather than encryption. Don't put a password or another secret there.
The signature lets your application check the signed content using the correct key and verification rules. An encrypted JWT has a different compact structure.
Make a sample you can inspect
This browser-console example creates an unsigned token with ASCII-only values:
const encode = value => btoa(JSON.stringify(value))
.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
const header = { alg: 'none', typ: 'JWT' };
const payload = { sub: 'demo-user', iat: 1704067200, exp: 1704070800 };
const demoToken = `${encode(header)}.${encode(payload)}.`;
console.log(demoToken);It has no signature and must never be accepted as a login credential. Paste it into the decoder and compare the claims with the example. If the tool rejects unsigned input, use its built-in sample instead.
For real applications, use a maintained JWT library with proper UTF-8 support rather than this small demonstration function.
Check the time claims
iat is the issued-at time, exp is the expiry boundary, and nbf, if present, says when use can begin. These values use seconds since the Unix epoch.
Our sample was issued at midnight UTC on January 1, 2024, and expired one hour later. It's an old test token. Changing an expiry field in a signed token breaks the signature; it doesn't extend the original credential.
If the displayed date is wildly wrong, check whether milliseconds were used where seconds were expected.
Check trust in the application
A decoded payload can help you spot a missing claim or an unexpected value. Before granting access, the application must verify the signature with trusted keys, enforce its allowed algorithms, and check the expected issuer, audience and time claims.
It must also decide whether that user can perform the requested action. A valid token doesn't automatically grant every permission.
The JWT security guidance explains common validation mistakes. Follow your library and protocol's instructions when implementing those checks.
For a simple decoding error, remove the Bearer prefix, surrounding quotes and accidental line breaks. Keep real credentials out of logs and public bug reports.
