Guide
How to decode a JWT safely (without trusting claims)
Inspect JWT header and payload in your browser. Learn why decoding is not verification, and which claims matter when debugging auth.
Published 2026-07-23
JSON Web Tokens carry claims between services. When auth fails, the fastest debug step is often to read the payload — without assuming those claims are authentic.
Decode vs verify
- Decode — read header and payload JSON from Base64URL segments
- Verify — check the signature with the correct algorithm and key
- Never authorize a request from decoded claims alone
Steps
- Paste the compact token into JWT Decode (Bearer prefix is fine).
- Inspect alg, typ, exp, and custom claims in the formatted output.
- If you need raw segment inspection, use Base64 with Base64URL-aware handling in your app, or JSON Formatter on decoded JSON.
Claims worth checking
- exp — is the token expired?
- nbf — is it used before it becomes valid?
- aud / iss — do issuer and audience match your API?
- alg — unexpected none or weak algorithms are red flags
Try these tools
JWT Decode
Decode JWT header and payload in your browser — inspect claims without uploading tokens.
Base64 Encode / Decode
Encode UTF-8 text to Base64 or decode Base64 back to text — instantly in your browser.
JSON Formatter
Format, beautify, and minify JSON in your browser. Free, private, and instant — no upload to a server.
Frequently asked questions
Does JWT Decode verify signatures?
No. It only decodes Base64URL segments. Signature verification requires your auth library and keys.
Is my token uploaded?
No. Decoding runs client-side on Tools by RS Roshi. Still avoid pasting production tokens on shared devices.
More long-form writing may also appear on blog.rsroshi.dev.