Debugging JWT Tokens

JWTs look scary because they're compact and signed, but under the hood each one is just three base64url-encoded chunks: header.payload.signature.

Decoding structure

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9       ← header
.
eyJzdWIiOiIxMjMiLCJpYXQiOjE3MDAwMDAwMDB9   ← payload
.
<signature bytes>

Base64url-decode the first two parts to read JSON. The signature is not encrypted — it's a hash-based MAC (HS256) or an asymmetric signature (RS256). JWTs are signed, not encrypted, so never put secrets in the payload.

Standard claims

Always check exp and verify the signature. Decoding without verifying is the #1 JWT security mistake.

Common algorithm choices

• HS256 — symmetric; shared secret. Simplest for monoliths.
• RS256 / ES256 — asymmetric; the issuer holds the private key, consumers hold only the public key. Use this when services that verify aren't the ones that sign.
• none — the "no signature" algorithm. Always reject tokens with alg: none on the server.

Debugging workflow

1. Paste the token — confirm the header decodes cleanly.
2. Check exp against current time (Unix epoch seconds).
3. Check iss and aud match expectations.
4. For HS256, paste the shared secret and verify.
5. For RS256, verify against the issuer's public key (JWKS endpoint).

Our JWT Analyzer does all of this in the browser — nothing leaves your machine.