How to Decode a JWT Token Safely

JSON Web Tokens (JWT) are widely used for stateless authentication and authorization between web clients and backend APIs. Understanding how to inspect token claims and expiration times is essential when debugging auth workflows.

You can inspect and decode any JWT safely using the Burnjet JWT Decoder.

---

The Anatomy of a JWT #

A standard JWT consists of three distinct parts separated by dots (.):

1. Header: Contains cryptographic metadata, specifying the token type (JWT) and the signing algorithm (such as HS256, RS256, or ES256).
2. Payload (Claims): Contains statements about the entity (user ID, username, roles) and metadata (issued at iat, expiration exp).
3. Signature: Cryptographic hash generated by signing the header and payload with a private key or secret.

---

Critical Security Rule: Decoding $\neq$ Verification #

Important: Decoding a JWT simply converts Base64Url characters back into readable JSON. Anyone can decode a JWT. Decoding does not prove the token was issued by a trusted server or that the payload has not been tampered with. Cryptographic verification must always be performed on your backend.

---

Step-by-Step: Using the Burnjet JWT Decoder #

Step 1: Open the Tool #

Visit Burnjet JWT Decoder.

Step 2: Paste Your Token #

Paste your token string into the input box.

Step 3: Inspect Decoded JSON and Expiration #

The tool parses the token in client memory and presents:

• Header Object: {"alg": "HS256", "typ": "JWT"}
• Payload Claims: User ID, email, scopes, custom claims.
• Expiration Status: Visual badge indicating whether exp is currently Active or Expired, with formatted UTC and local date timestamps.

---

Related Developer Tools #

• Base64 Encoder / Decoder: Learn how Base64Url encoding works.
• Cryptographic Hash Generator: Generate SHA-256 hashes.
• UUID Generator: Generate random v4 UUID identifiers.