JWT Decoder Explained: Inspect Tokens Safely

What you see when you decode a JWT

Decoding a JWT reveals its header and payload claims — who the token is for, when it expires, and what custom fields your API attached — without yet proving the token is genuine.

A JSON Web Token has three Base64URL-encoded parts separated by dots: header, payload, and signature. Decoding the first two yields JSON you can read. The signature is binary data meant for verification, not casual reading.

BrowserTools.tech JWT Decoder parses those segments in your browser so you can inspect structure quickly during development and incident response.

Header and payload fields to know

The header usually states the signing algorithm (alg) and token type (typ). The payload holds registered claims and your application-specific data.

• sub — subject, often a user ID.
• iss — issuer that minted the token.
• aud — intended audience for the token.
• exp — expiration time as a Unix timestamp.
• iat — issued-at time; useful for skew debugging.
• Custom claims — roles, tenant IDs, feature flags (names vary by API).

Decoding is not verification

Anyone can Base64URL-decode the header and payload of a JWT. That readability is by design — JWTs are signed, not encrypted, unless you use nested JWE patterns.

Signature verification requires your secret or public key and belongs in your auth stack — API gateways, backend middleware, and properly configured libraries — not in a casual paste on a shared machine. A decoded token that looks valid can still be forged if the signature was never checked.

Safe workflow with BrowserTools.tech

Use JWT Decoder to answer development questions: Is exp in the past? Does aud match our API? Are roles present in the claim set you expected after login?

Paste into JSON Formatter afterward if you want pretty-printed claim JSON for a ticket or runbook — still locally in the browser for the formatter step.

• Paste the token into JWT Decoder.
• Inspect header alg and typ — unexpected alg values can signal attacks.
• Read exp and nbf relative to current time when debugging 401s.
• Never paste live production secrets into tools you do not control end-to-end.
• Redact tokens in screenshots and support threads.

Common debugging scenarios

Clock skew between issuer and consumer causes intermittent auth failures — compare iat and exp with server time. Wrong aud or iss often means the token was minted for a different environment (staging vs production).

Oversized custom claims bloat cookies and headers. Decoding helps you spot accidental embedding of large JSON blobs that should live server-side.

Base64 and JWT: related but different

JWT segments use Base64URL encoding, a URL-safe variant. BrowserTools.tech Base64 Encode tool helps with other debugging contexts — data URLs, manual segment inspection — but JWT Decoder handles the full three-part structure and JSON parsing for you.

Remember: decoding helps you read claims; only your verifier proves integrity. Treat decoded output as hints, not proof of trust.