2026-04-19 · 1 min read
How to decode JWT safely
Inspect tokens locally first; verify signatures only on the server.
Key takeaways
- Decoding shows structure, not trust—signature verification belongs on the server.
- Always check exp/iss/aud before using claims in business logic.
Recommended workflow
Paste the token into JWT Decoder to read header and payload fields.
Confirm exp is in the future for your clock skew tolerance, and that iss/aud match your issuer configuration.
In your backend, verify the signature with the correct key material and algorithms—never rely on browser decoding alone.
Limits of client-side tools
Browser-side decoding is for debugging and education. Treat it as read-only inspection, not authorization.
If a token is leaked, assume compromise: rotate keys and invalidate sessions according to your threat model.
FAQ
Does decoding prove the token is valid?
No. Anyone can base64-decode JWT parts; validity requires cryptographic verification.
Should I paste production tokens here?
Avoid secrets in shared screens. Prefer test tokens or redact sensitive claims.