How to Inspect and Decode JWT Tokens

Problem

You received a JWT and want to see its contents (claims, expiration, issuer) without the signing key.

Prerequisites

• Understanding of JWT structure
• Knowledge of Base64url encoding

Steps

1. 1. Split the token into parts

   A JWT has three Base64url-encoded parts separated by dots: header.payload.signature. Split on the dot character. If there are not exactly three parts, it is not a valid JWT. The parts are Base64url-encoded (use - and _ instead of + and /, no padding).

   Input

   eyJhbGci...eyJzdWIi...SflKx...

   Output

   3 parts: header, payload, signature

2. 2. Decode the header and payload

   Base64url-decode the first part (header) and second part (payload) to JSON strings, then parse them. The header contains the algorithm and type. The payload contains claims like sub (subject), iss (issuer), exp (expiration), iat (issued at), and custom claims. The signature (third part) cannot be decoded to meaningful data without the key.

   Input

   decode parts

   Output

   header: {alg:'HS256'} | payload: {sub:'123',exp:1697254800}

3. 3. Interpret the claims

   Read the standard claims: exp (expiration timestamp — is the token still valid?), iat (issued at), nbf (not before), iss (issuer), aud (audience). Check custom claims for application-specific data. Remember: decoding does not verify the signature — the token could be forged. Always verify before trusting.

   Input

   exp: 1697254800 (past)

   Output

   token expired

Expected result

The JWT header and payload decoded and displayed, with claims interpreted.

Common errors

Treating a decoded token as verified

Decoding only reads the content. It does not prove the token was signed by the legitimate issuer. Always verify the signature before trusting the claims.

Base64url decoding fails

JWT uses Base64url encoding (with - and _ instead of + and /, no padding). Use a Base64url decoder, not a standard Base64 decoder. Restore padding before decoding if needed.

Troubleshooting

• If decoding produces garbage, the parts may not be Base64url-encoded. Check the token format.
• If the token has extra parts (more than 3), it may be a JWE (encrypted) or a different format.

Security limits

• Decoding a JWT is safe — it only reads encoded data. But never trust the claims without signature verification.
• JWT inspection is for debugging and understanding. Do not make access control decisions based on unverified claims.
• This tool decodes locally. No token is transmitted.