5 JWT Debugging Tasks Every Developer Should Bookmark

JWTs show up everywhere — auth headers, session cookies, API gateways — and debugging them usually means someone pasting a token into a random website and hoping it's not logging it. Here are five recurring JWT tasks worth having a fast, trustworthy tool for.

1. Decoding header and payload

A JWT is just three Base64URL-encoded segments joined by dots — header, payload, signature. You don't need jwt.io or a library to read one; you need a JWT Decoder that splits it and renders the header and payload as readable JSON in one paste.

2. Checking expiry without doing the math

The exp claim is a Unix timestamp, and mentally converting 1785340800 into a date is not a good use of anyone's time. A decoder that surfaces exp, iat, and nbf as human-readable dates next to the raw value saves the round trip to a timestamp converter.

3. Spotting algorithm mismatches

The alg field in the header (HS256, RS256, none) is a classic attack surface — a server that trusts the client-supplied algorithm is vulnerable to alg: none forgery. Inspecting the decoded header before you trust a token catches this at a glance.

4. Inspecting custom claims

Most tokens carry more than sub and exp — roles, tenant IDs, scopes, feature flags. When a permissions bug shows up in production, decoding the actual token a user has (not the one you assume they have) is usually the fastest way to confirm what's wrong.

5. Verifying structure before debugging further

"Invalid token" errors are often just malformed input — a truncated copy-paste, a missing segment, extra whitespace. Decoding first tells you immediately whether you're dealing with a structurally broken token or a genuine signature/claims problem downstream.

The common thread

None of this requires sending a token — which may contain live session data — to a third-party server. A JWT Decoder that runs entirely client-side means the token never leaves your browser, which matters more for JWTs than almost anything else you'll paste into a dev tool.

Quick checklist before you trust a JWT:

• Decode header + payload, confirm alg matches what your server expects
• Check exp hasn't passed and nbf has
• Confirm claims match the identity/permissions you expect
• Never decode a production token on a site you don't control