JWT and authentication debugging tools
Decode the token, check the claims, generate a test token, verify the signature.
Most authentication bugs come down to a token that’s expired, scoped wrong, or sent in the wrong shape. This workflow inspects a bearer token end to end: decode it to read its claims, check the expiry against the current time, look at the raw Base64 segments when the decode looks off, mint a fresh test token with the right claims, and verify hashes and request headers. Nothing you paste — token, secret, or header — leaves your browser.
- 1
Decode the token
Split the JWT into header, payload, and signature and read every claim. Remember that decoding is not verification — the payload is readable by anyone, so never trust it without checking the signature server-side.
- 2
Check expiry and timestamps
Convert the exp and iat claims (Unix timestamps) to human-readable dates to confirm whether the token is simply expired or not yet valid.
- 3
Inspect the Base64 segments
When a token won’t decode, Base64url-decode each dot-separated segment by hand to find the malformed part — often a truncated copy-paste or a wrong-alphabet segment.
- 4
Generate a test token
Mint a signed JWT with the exact sub, scope, and expiry your endpoint expects, so you can reproduce and isolate the auth behaviour in a test.
- 5
Verify hashes and signatures
Compute a hash or an HMAC to check a signature, an API-key digest, or a webhook signing secret against what the server expects.
- 6
Check the request headers
Parse the raw request headers to confirm the Authorization header is well-formed, and generate the CORS headers a browser preflight needs.
Frequently asked questions
Decoding just Base64url-decodes the header and payload — anyone can do it, and it proves nothing because the contents are not secret. Verifying checks the signature against a key to prove the token was issued by who it claims and hasn’t been tampered with. A JWT decoder is for inspection while debugging; verification must happen server-side with the signing key.
Decode the token and read its exp claim, which is a Unix timestamp. Convert that timestamp to a human-readable date — if it’s in the past, the token is expired. A token can also fail on the nbf (not-before) claim if it’s used before its validity window starts.