JWT decode vs verify: what a browser decoder is for
Decoding a JWT shows header and payload claims. Verification proves the signature—and must happen on a trusted server.
Three parts
A typical JWT has a header, payload, and signature separated by dots. The first two parts are Base64URL-encoded JSON. Decoding them is convenient for debugging expiry (exp), subject (sub), and issuer (iss).
Decode is not trust
Anyone can craft a token with a friendly payload. Without signature verification using the correct key, you must not authorize actions based on decoded claims alone.
Safe debugging habits
Prefer staging tokens. If you must inspect a production token, do it locally, avoid pasting into untrusted sites, and rotate credentials if a token may have leaked.
Try related tools
- JWT decoder — Inspect JWT header and payload (no signature verification).
- Base64 — Encode and decode text with Base64 for quick sharing or debugging.
- Unix timestamp — Convert between Unix seconds, milliseconds, and local time.