JWT Decoder vs. Verifier: How to Inspect Claims and Token Expiry

Does decoding a JWT mean it is valid?

No. Decoding reads the contents; verification checks a signature with an appropriate key. Application validation decides whether a verified token is acceptable for a particular request. Treat these as separate steps when debugging a login failure.

The common signed compact token has three dot-separated parts: header, payload, and signature. The first two are Base64URL-encoded data, not encrypted secrets. Other JWT representations exist; StatFlare's decoder is intended for the three-part format. Use a test token and test keys when exploring how it works.

Inspect the claims before guessing at the failure

Look for exp, nbf, iss, and aud. They describe expiry, the earliest acceptable time, the issuer, and the intended recipient. An expiry value is a NumericDate measured in seconds since the Unix epoch. Comparing it directly with JavaScript's millisecond clock produces the wrong answer.

The JWT specification defines these registered claims and their time representation. Claim requirements depend on the protocol using the token. Missing data should be assessed against your application's contract rather than filled in by a debugging tool.

What a signature check does and does not establish

A successful check establishes that the signature matches the supplied key and signed bytes under the chosen algorithm. It does not establish that you supplied a trusted key, that the issuer is the one your application accepts, or that the token grants permission for this action.

For production validation, use a maintained JWT library with the expected algorithms and trusted key source configured by the application. Validate the expected issuer, audience, and time claims as required by your protocol. The JWT security guidance explains algorithm and issuer validation. A token's own algorithm header must not define your trust policy.

A practical expired-token investigation

Decode a non-sensitive test token, inspect exp, and compare its UTC time with the server's clock. If the token has expired, obtain a replacement through the application's supported authentication flow. Editing the payload invalidates an existing signature and does not extend a legitimate session.

If time looks correct, inspect the intended audience, issuer, and the server's validation error category. Keep raw tokens out of logs and support tickets. An online decoder is a diagnostic aid; the API that accepts the request must enforce authentication and authorization itself.

Frequently asked questions

Is a JWT payload private? A typical signed JWT's payload is readable by anyone holding the token. Signing does not encrypt its contents.

Does a green signature result mean I am logged in? No. The receiving application still has to trust the key, validate required claims, and authorize the request.

Should I paste my production signing secret into a tool? Use a test secret and test token for debugging. Keep production signing credentials in their intended server environment.