JWT Decoder Guide: Debug Tokens Without Creating Security Risks

The payload might include:

• iss: issuer.
• sub: subject, often the user ID.
• aud: audience.
• exp: expiration time.
• iat: issued-at time.
• nbf: not-before time.
• scope or permissions: allowed actions.
• Custom app-specific claims.

Seeing these values makes many auth problems obvious.

Common JWT Debugging Scenarios

The token is expired. Check exp. JWT timestamps are usually Unix timestamps in seconds, not milliseconds. Use a Unix Timestamp Converter if needed.

The audience is wrong. A token issued for one API may be rejected by another. Check aud.

The issuer does not match. Staging and production identity providers may have different issuer URLs. Check iss.

The user has the wrong role. Inspect role, scope, or permission claims.

The token is not active yet. Check nbf.

The frontend sends the wrong token. Decode the token being sent, not the token you think is being sent.

Do Not Paste Sensitive Tokens Everywhere

JWTs can be sensitive. A bearer token may grant access to an account or API. Treat it like a password while it is valid.

Safer habits:

• Decode tokens locally or in tools you trust.
• Avoid pasting production tokens into random websites.
• Redact tokens in screenshots and logs.
• Use short-lived test tokens for debugging.
• Never commit tokens to code or documentation.
• Rotate exposed tokens immediately.

If a token grants access, assume anyone who sees it can use it until it expires or is revoked.

Decoded Does Not Mean Valid

Because JWT header and payload are just encoded JSON, anyone can decode them. Anyone can also create a fake JWT payload.

For example, a malicious user could change:

to:

The changed token should fail signature verification. If your backend trusts decoded payloads without verifying signatures, that is a serious security bug.

Your server must verify:

• Signature.
• Algorithm.
• Issuer.
• Audience.
• Expiration.
• Not-before time.
• Required claims.

Never trust a token because it "looks right."

Algorithm Confusion Risks

JWT verification must restrict allowed algorithms. Do not blindly accept whatever algorithm the token header says.

Dangerous patterns include:

• Accepting none algorithm.
• Confusing symmetric and asymmetric keys.
• Not pinning expected algorithms.
• Using the wrong public key.
• Skipping issuer or audience checks.

Modern libraries usually help prevent these mistakes, but configuration still matters.

Storage and Transport

JWT bugs are not only about token content. They also come from where tokens are stored and how they are sent.

Check:

• Is the token sent in the Authorization header?
• Does it include the Bearer prefix?
• Is it stored in memory, cookies, or local storage?
• Are cookies using HttpOnly, Secure, and SameSite where appropriate?
• Is the token sent over HTTPS only?
• Are refresh tokens protected more carefully than access tokens?

Authentication failures often come from missing prefixes, stale storage, wrong cookie domains, or mixed environments.

A Practical Debugging Workflow

1. Capture the exact failing request with an API Tester.
2. Copy the token from that request.
3. Decode the JWT.
4. Check exp, iss, aud, sub, and scopes.
5. Compare against a known-good token.
6. Verify backend configuration.
7. Check whether the frontend is sending the right token.
8. Redact the token before sharing logs.

This workflow avoids guessing and keeps the investigation tied to the real request.

Common JWT Mistakes

Using decode as authorization. Decoding is inspection. Verification is security.

Ignoring expiration units. Seconds and milliseconds are easy to confuse.

Logging full tokens. Logs live longer than requests.

Mixing refresh and access tokens. Refresh tokens deserve stronger protection.

Putting too much data in the payload. JWT payloads are readable by clients. Do not store secrets there.

The Bottom Line

A JWT decoder is an excellent debugging tool. It helps you see why a token is accepted, rejected, expired, mis-scoped, or meant for the wrong audience.

Just keep the boundary clear. Decode to inspect. Verify to trust. Redact before sharing. Rotate anything exposed.