How to read a JWT: inspect its claims without mistaking decoding for verification

When an API rejects a JWT, decoding it can help you inspect its expiry, issuer and intended audience. It cannot establish that the token is genuine. Anyone can write a plausible-looking header and payload; the server must verify the cryptographic protection and the claims it requires.

The JWT decoder reads the three-part signed form in your browser. Start with its example token when learning the format. A real bearer token may grant access to an account, so keep it out of public bug reports and screenshots.

Three parts in the signed compact form

encoded-header.encoded-payload.signature-or-MAC

The first two parts are Base64url-encoded JSON. Base64url uses - and _ instead of standard Base64’s + and /, and JWT compact encoding omits padding. The final part encodes binary signature or MAC bytes, not another JSON object.

A decoded header might be:

{ "alg": "HS256", "typ": "JWT" }

A separate illustrative payload might be:

{
  "sub": "user-1234",
  "name": "Jane Doe",
  "iat": 1753487000,
  "exp": 1753490600
}

These JSON examples show the fields, not a signed credential. A three-part string is not automatically a valid JWT merely because its first two sections can be decoded.

Read the claims as assertions to check

Claim	What it describes	What to compare
iss	Issuer	The issuer your application trusts
sub	Subject	The user or entity the token identifies
aud	Intended audience	The receiving API or application
exp	Expiration time	The server’s current time
nbf	Not-before time	Whether the token may be accepted yet
iat	Issued-at time	Whether the timestamp is plausible
jti	Token identifier	Any application-specific tracking or revocation rule

These registered claims are not all mandatory in every JWT profile. The protocol or application defines what must be present. For example, an OpenID Connect ID token and an API access token do not have identical purposes or acceptance rules.

Expiry values are seconds, not milliseconds

JWT time claims use NumericDate: seconds since 1 January 1970 UTC, ignoring leap seconds. In the payload above:

• iat: 1753487000 is 25 July 2025 at 23:43:20 UTC;
• exp: 1753490600 is 26 July 2025 at 00:43:20 UTC.

They are one hour apart. The expiration value is a timestamp, not “seconds remaining”. JavaScript timestamps are commonly in milliseconds, so confusing the units can produce an implausible date.

The local decoder displays these claims using your device’s current clock. Its expiry display is a debugging aid, not the server’s decision. A verifier must enforce expiration and any permitted clock tolerance; without tolerance, a token must not be accepted at or after exp.

What the signature or MAC contributes

HS256 uses an HMAC with a shared secret. Anyone holding that secret can create as well as verify tokens. RS256 and ES256 use a private key for signing and the corresponding public key for verification.

The protection covers the encoded header and payload. Verification with the correct trusted key can detect alteration, but the server must also restrict accepted algorithms and validate the token’s intended use. It must not simply trust whatever alg the incoming header requests.

The JWT best-current-practice document covers algorithm checks, key strength, issuer and audience validation. Weak keys or incorrect verification can defeat the intended protection.

Signing does not hide the claims. The distinction from encryption is explained in Base64 is not encryption. The local decoder does not verify signatures and does not ask for keys.

Five parts can mean an encrypted JWT

JWT is broader than the three-part form. Compact JSON Web Encryption (JWE) has five parts and can carry encrypted JWT claims. It will not be decoded by this tool’s three-part parser.

Other credentials are opaque strings with no readable JWT structure. Check the issuing system’s format rather than concluding that any token rejected by this decoder is malformed.

Use the decoded fields to narrow a rejection

Check whether the token was copied completely, whether exp has passed, whether nbf is still in the future, and whether iss and aud match the service you called. Then inspect the server’s verification result for key selection, algorithm and signature errors.

A valid signature does not necessarily mean the application will accept the token. It can also check account state or a revocation list. JWTs can be revoked through such server-side mechanisms; the format simply does not supply automatic revocation by itself.

Last reviewed 2 October 2026.