How to Decode and Inspect JWT Tokens Safely

Learn to read JWT headers and payloads, check expiry claims, and debug auth issues without exposing secrets.

KPM Editorial · Developer · 2026-10-10 · 5 min read

What the JWT Decoder Does

A JSON Web Token looks like three base64 strings joined by dots. The JWT Decoder splits the header, payload, and signature sections, decodes them into readable JSON, and surfaces key claims like exp, iat, sub, iss, and scope. You see who issued the token, when it expires, and what permissions it carries.

Use it when your login works but API calls return 401, when you need to confirm roles, or when you are wiring up OAuth, Firebase, Supabase, or a custom auth server and want to verify the payload shape.

Step-by-Step: Inspect a Token

1. Copy the full token from your devtools network tab, console log, or Authorization header. It should have two dots separating three segments.
2. Paste it into the JWT Decoder input. The header and payload appear instantly as formatted JSON with no submit button needed.
3. Read the header for algorithm like HS256 or RS256 and token type. Confirm it matches what your backend expects.
4. Read the payload claims. Check exp for expiry time, iat for issued time, sub for user id, and any roles or scopes array.
5. If the token looks expired, convert the exp timestamp to a readable date and compare it to the current time to confirm clock skew or refresh logic bugs.
6. Copy the decoded payload for docs or bug reports, but redact emails and personal ids before sharing screenshots with teammates.

Practical Tips That Save Time

• Never paste secrets: decode only on trusted local tools. Do not share live production tokens in chat or public debuggers.
• Check expiry first: most 401 errors are simply expired tokens or missing refresh calls, not broken permissions code.
• Verify audience: confirm iss and aud match your project. A token for staging will fail on production by design.
• Look for missing roles: if admin pages block you, inspect the roles array before rewriting route guards.
• Test refresh flow: decode tokens before and after refresh to confirm new expiry and unchanged user id.

Example Workflow

Your app logs in but profile fetch fails. Paste the access token and see exp is yesterday and scope lacks profile read. You now know to fix the refresh timer and request the correct scope, instead of rebuilding the whole auth context. A second decode after the fix shows a fresh expiry and full scopes.

Privacy Note

Decoding happens entirely in-browser with no uploads. Tokens often contain emails, user ids, and permissions, so local processing keeps them off remote servers and out of logs. For extra safety, use short-lived test tokens while debugging and revoke any token you accidentally pasted elsewhere.