What a JWT contains
A JSON Web Token usually has three parts: a header, a payload, and a signature. The payload may include claims such as issuer, audience, subject, roles, and expiry time. Decoding a token can help you understand why a login or API request behaves a certain way.
What decoding does not prove
Decoding is not the same as verifying. Anyone can decode the readable parts of many tokens. Verification checks whether the signature is valid and whether issuer, audience, and expiry rules make sense for your application.
Safe debugging habits
- Do not paste active production tokens unless the tool is local and trusted.
- Check expiry and audience first when debugging access problems.
- Do not publish screenshots that include full tokens.
- Rotate credentials if a sensitive token was exposed.
FAQ
Can a decoded token expose private data?
Yes. Claims can include names, emails, tenant IDs, roles, or other identifying information.
Does a JWT decoder need a secret key?
Basic decoding does not. Signature verification may require a public key, secret, or issuer metadata.