How to Debug a JWT Safely Online
Decode a token locally while remembering that decoding does not verify its signature.
Step by step
- Paste the JWT into the local browser tool.
- Inspect the header and payload fields.
- Check timestamps such as expiration and issued-at values.
- Verify signatures separately with your service or trusted key; never paste production secrets into untrusted tools.
How a JWT is structured
A JSON Web Token has three Base64URL-encoded parts separated by dots: a header that names the signing algorithm, a payload with claims such as sub, iss, aud, exp and iat, and a signature that proves the token was issued by someone holding the key.
Because the header and payload are only encoded, not encrypted, anyone with the token can read them. Never store passwords or other secrets in JWT claims.
Common JWT problems
Most authentication bugs come from expired tokens, clock differences between servers, the wrong audience or issuer, or a mismatch between the algorithm in the header and the one your server expects. Comparing exp and iat with the current time usually explains sudden 401 errors.
Why decoding locally matters
Access and refresh tokens can be used to act as the user until they expire. Decoding them in a browser-only tool keeps them off third-party servers, but you should still prefer test tokens and revoke any production token you have shared by mistake.
Decode tokens locally with MiniFyn JWT Debugger.
Try MiniFyn →