What's inside a JWT
A JSON Web Token is three pieces of Base64URL-encoded JSON-ish data joined by dots: a header describing how the token is signed, a payload holding the actual claims (user ID, roles, expiry, and whatever else the issuer put in), and a signature. The header and payload are encoded, not encrypted — anyone who has the token can read them, which is exactly why JWTs typically travel over HTTPS and why sensitive data shouldn't be put in the payload.
This is why a JWT debugger is genuinely useful during development: when an API call fails with a 401, decoding the token you sent instantly answers the two most common questions — did it expire, and does the payload actually contain the claim the server is checking for?
Reading the result
- Header — typically just
alg(the signing algorithm, like HS256 or RS256) andtyp("JWT"). - Payload — the claims. Some are standard (
sub,iss,aud,exp,iat,nbf); most APIs add their own on top. - Expiry status — computed from
expagainst your device's current time, so you can tell at a glance whether a stored token is why a request is being rejected.
Verifying a token instead of just reading it
If you need to confirm a token is authentic — not just well-formed — that check has to happen wherever the signing key lives, typically your backend. In Node.js, for example:
const jwt = require("jsonwebtoken");
const payload = jwt.verify(token, secretOrPublicKey);If the signature doesn't match, verify throws — decoding alone, as this tool does, can't tell you that.