Start with the header algorithm
Check whether the alg value matches the algorithm your environment is supposed to use. A mismatch is a common source of failed verification.
JWT Decoder/Inspector
🔒 Browser-side processing
Decode JWTs, inspect claims, review expiry, and verify signatures with JWKS.
Guide
What to inspect first in a JWT
Review time-based claims
exp, nbf, and iat should be interpreted alongside server clock differences. Time drift often looks like a token issue at first.
Check payload sensitivity
JWTs are only encoded, not encrypted. If the payload contains sensitive personal or secret values, the token design itself may need review.
More: how to use it, examples, and common errors
Security Notes
Decoding is not the same as trust
Readable does not mean valid
Being able to decode a token only means you can inspect it. Trusting it still requires signature validation.
Why the JWKS step matters
In OIDC and external identity-provider setups, JWKS verification helps confirm that the token actually came from the issuer you expect.
Useful companion tools
JWT debugging often pairs well with JSON Formatter, the Base64 converter, and API Request Tester when you need to reproduce the full request flow.
How To
The order that makes JWT review easier
1. Open the header and payload first
Start by comparing alg, typ, iss, aud, sub, and exp against the environment you expect. That narrows the problem quickly.
2. Review time claims with a timestamp tool
Translate exp, nbf, and iat into human-readable time and account for server clock skew. The timestamp converter pairs well with this step.
3. Treat trust as a separate verification step
A readable token is not automatically a trustworthy one. When an external issuer is involved, use the JWKS URL to verify the signature explicitly.