Reading a JWT without trusting the server

Published: 2026-07-20

How JWT structure, Base64URL encoding, and signatures work — and why decoding locally beats pasting tokens into random websites.

A JSON Web Token (JWT) is a compact string that carries claims (user id, roles, expiry) and optionally a signature proving who issued it. Developers decode JWTs constantly when debugging OAuth, API gateways, and session cookies — but pasting a live token into an unknown website sends your credential to someone else’s server.

The three parts

Most JWTs look like header.payload.signature, each segment Base64URL-encoded JSON (for header and payload) or bytes (for signature):

eyJhbGciOiJIUzI1NiIs...  .  eyJzdWIiOiIxMjM0...  .  SflKxwRJ...
|-------- header --------|  |------ payload -----|  |-- signature --|
  • Header — usually alg (algorithm) and typ (JWT).
  • Payload — claims such as sub, exp, iat, and custom fields.
  • Signature — HMAC or asymmetric proof; verifying it requires the issuer’s secret or public key.

Decoding (reading header and payload) is not the same as verifying the signature. Anyone can Base64URL-decode the middle segment; only someone with the key can confirm the token was not tampered with.

Claims to check first

Claim Meaning
exp Expiry time (Unix seconds). Compare to now.
nbf Not valid before this time.
iat Issued-at timestamp.
aud Intended audience — your API id should match.
iss Issuer URL or identifier.

An unsigned or wrongly signed token can still decode to plausible JSON. Never trust payload content until signature verification succeeds with the correct key.

Why “online JWT decoders” are risky

Many decoder sites POST your token to their backend for “convenience.” A bearer token in transit may be logged, indexed, or reused. For production debugging:

  • Prefer local decoding in your browser tab or CLI.
  • Redact tokens in screenshots and tickets.
  • Use short-lived test tokens when possible.

Try it locally

The JWT Debugger on LocalTools decodes and inspects tokens in your browser. HMAC signing for test tokens also stays client-side — your secret is not uploaded for processing.

For password and token hygiene in general, see Generating passwords and tokens in the browser.

Related reading

← All learn articles