Reading a JWT does not prove that its claims are trustworthy

While debugging a login, you decode a JWT and see a user identifier and an expiry time. If the content is readable, can someone change it? Decoding, checking integrity and deciding whether an application should accept the token are different steps. Keeping those steps separate makes the decoder’s results much easier to interpret.

The familiar three-part token uses JWS compact form

In the three-part compact representation, dots separate a header, a payload and a signature or MAC. A JWT payload contains claims: values about a subject or conditions, such as sub and exp. The JWS header and payload are Base64url-encoded, not encrypted text.

JWS is not the only JWT representation

JWTs can also be encrypted with JWE; its compact form has five parts. Online Tools JWT Decoder reads the three-part form. It does not decrypt JWE or implement every JOSE extension. Even for a three-part input, successful decoding does not establish a valid signature.

Read an explicitly unsigned learning sample

This sample was made for the explanation. It uses alg none, has no signature and expired in 1970. It is not a credential for a service: it demonstrates that unprotected claims can still be decoded. Include the final dot when copying it.

Input

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJkZW1vIiwiaWF0IjowLCJleHAiOjYwfQ.

Decoded header and payload

An exp of 60 means 1970-01-01 at 00:01:00 UTC, or 09:01:00 in Japan. The decoder can report that this time has passed without checking any signature. This is not a recommendation to accept none unconditionally in an authentication system.

{"alg":"none","typ":"JWT"}

{"sub":"demo","iat":0,"exp":60}

Verification uses an allowed algorithm and a trusted key

Decoding reverses a representation. A payload containing admin is not, by itself, grounds to grant that role. Cryptographic verification checks the signed input with an algorithm allowed by the application and an appropriate trusted key. The token’s alg field must not dictate the verifier’s entire acceptance policy.

A valid signature still leaves application checks

A correctly signed token might have been issued for another service or a different purpose. The application must apply its issuer, audience, time and token-type rules as appropriate. Use a maintained JWT implementation for that job; splitting a string into segments is not an authentication implementation.

exp, nbf and iat describe different moments

NumericDate represents seconds since the Unix epoch. JavaScript Date uses milliseconds, so mixing the units can produce an unexpected date near 1970. The timezone used to display a value is also separate from the clock used to judge it.

Read the time claims

These registered claims are optional in the base JWT specification; a particular authentication profile may require them. Small clock-skew allowances are permitted. Online Tools uses the device’s current clock for its display, so it does not reproduce the server’s allowance or revocation state.

Claim	Meaning	Basic interpretation
exp	Expiration time	Expired when the current time reaches or exceeds exp
nbf	Not-before time	Too early while the current time is below nbf
iat	Issued-at time	Does not establish an expiry by itself

Displaying iss or aud is not validating it

iss identifies an issuer and aud identifies intended recipients. One issuer may serve several applications, so checking the issuer alone is not enough. An audience can be a single string or an array containing several recipients.

What the decoder cannot establish

Online Tools does not verify a signature or MAC, issuer or audience. It cannot tell whether a token was revoked, already used, or still authorizes the requested action. Its JSON.parse-based display can also lose information from duplicate claim names or extremely large numbers. Do not feed the displayed object straight into an authentication decision.

Use the sample to inspect the format, and the application to validate access

Paste the sample into JWT Decoder to inspect its header, payload and UTC/Japan time displays. That answers what the token says. Whether a real service should accept a token belongs to that service’s validation process.