JWT Decoder — Read a Token's Claims Without Trusting It
A JSON Web Token is three Base64url segments separated by dots: a header naming the algorithm, a payload of claims, and a signature. Decoding shows you the first two. The critical thing to hold onto is that decoding is not verifying — anyone can read a token's contents, and only the signature check establishes that it is genuine.
When it helps
Because most token problems are visible in the claims. An expiry in the past explains a rejection immediately, and a clock skew between issuer and verifier explains a token that is rejected as not yet valid. Missing or misspelled claims explain an authorisation failure where authentication clearly succeeded. Reading the payload turns "the API says 401" into a specific statement about which claim is wrong.
Worth running automatically
Two failures are worth monitoring, and both are silent. Signing keys rotate, and a verifier still holding the old key rejects every freshly issued token — an outage that begins at a rotation nobody announced. And tokens themselves expire, including the long-lived service credentials that were issued once and forgotten. A scheduled check that authenticates against an endpoint the way a real client does catches both, well before the expiry that would otherwise be discovered at the worst moment.
What you get out of it
Turns an opaque authentication failure into a named claim, in seconds. The reminder that decoding is not verification is worth as much as the decode itself.