A JWT decoder can help inspect an application token while debugging. The visible payload is only a set of claims until the application verifies its authenticity and intended use.
Open the JWT Decoder to follow the workflow. Processing runs in your browser; the tool does not upload the input for conversion.
Read the header and payload separately
The header describes details such as the algorithm. The payload contains claims such as a subject or expiry. This workspace expects three dot-separated segments and decodes the header and payload as Base64URL JSON. Encrypted five-segment JWE tokens are not handled by this decoder.
Interpret time claims carefully
Numeric iat, nbf and exp claims are converted to UTC dates. A future expiry claim is not proof that the token is valid. Correct verification also involves the signature and application rules such as issuer, audience and allowed algorithms. The workspace explicitly reports signatureVerified as false.
Use a demonstration token when learning
The Load example action provides readable sample claims with a demonstration signature. It is not an authentic credential. For application debugging, use an appropriate test token and keep the result within your authorised workflow. The tool does not contact a token issuer or a verification server.
A practical workflow
- Use the example or paste a test JWT. A supported token has three dot-separated segments.
- Decode the token. Run Process input; no signature verification takes place.
- Inspect claims and UTC dates. Read the header, payload and available iat, nbf and exp conversions.
- Use the report for inspection only. Copy/download the JSON, and leave authentication decisions to the application verifier.
Inspect the demonstration token
Load example provides an HS256 header and readable sample claims. Its demonstration signature is not genuine. The output correctly keeps signatureVerified false, even though the JSON payload can be read and the expiry claim can be displayed.
If the result needs attention
Readable claims are not proof that a token is authentic. Do not use the expiry display as an authorisation decision; the application must verify the signature and claims.
Read the exact error before changing the input. Keep a copy of the original, reduce the sample when investigating a large file, and use the destination application to verify that the result has the meaning you intended. The tool processes the supplied data; it cannot infer an unstated application schema or project requirement.
Use the Text Diff Checker to compare a saved result with the original. Keep transformation and application testing as separate steps so presentation changes are not mistaken for verified behaviour.
Sources and further reading
Turn the next step into a project
Need help with a brand identity, business website or launch assets? Explore SOPIDOTECH services and client projects, or discuss your brief.