How to Decode a JWT Safely in Your Browser
Learn how to inspect JWT headers and payloads without confusing decoding with token verification.
JWTs are easy to encounter in browser storage, authorization headers, and API debugging sessions, but their compact format can make them hard to inspect. Before changing application code, developers often need to see the header and payload to understand an issuer, expiry, audience, or custom claim.
A JWT has three dot-separated parts: a header, a payload, and a signature. Decoding the first two parts only converts Base64URL data into readable JSON; it does not prove that the token was issued by a trusted party or that its signature is valid.
For a quick local inspection, open /tools/jwt-decoder and paste a token you are allowed to examine. Check the alg field, expiration claim, and expected audience, then compare those values with the settings used by the application or identity provider.
Avoid pasting production secrets into unknown websites, chat tools, or issue trackers. A decoder is useful for troubleshooting, but a token can still grant access until it expires, so treat it with the same care as a password or session cookie.
Common mistakes include trusting the decoded payload without verification and assuming every JWT uses the same claims. Use decoding to understand structure, then let your server-side authentication library validate the signature, issuer, audience, and expiry before it accepts a request.