Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
When an API rejects a JWT, decode its header and claims to see what the token says—but do not mistake readable data for a valid credential. A useful diagnosis compares those values with the receiving service’s expected token profile, then checks the signature and policy rules with the application’s trusted keys and validation library.
How do I decode a JWT?
A conventional signed JWT in compact form has three base64url-encoded sections separated by periods: a header, a payload, and a signature. The header and payload can be decoded to inspect their JSON contents. Encrypted or nested JWTs can have different structures, so do not assume every token has three readable sections. The JWT standard describes the format in RFC 7519.
- Capture the exact token from the failing request in a safe development environment. A bearer token grants access to whoever holds it; do not paste a live credential into a public debugger or put the full value in logs.
- Check its structure. For the common signed compact form, look for three period-separated sections. A missing section or unexpected format may mean the application received a different token type, a truncated value, or a token that must be handled differently.
- Decode the header and payload with a JWT debugger or a local tool appropriate to your environment. Read the header fields and claims as data; decoding alone does not authenticate them.
- Compare the decoded values with the API’s configuration, including its accepted algorithm, trusted issuer and key source, expected audience, time policy, token type, and required permissions.
- Run the same token through the application’s established validation library or middleware and identify the specific failed check. Keep diagnostic logs focused on the validation error or claim name, not the complete token.
The jwt.io JWT Debugger provides a visual way to inspect tokens and an optional signature-verification workflow. Treat it as a debugging aid, not as a substitute for the receiving service’s server-side validation.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What should I inspect in the JWT?
Start with the header and the claims that describe who issued the token, who it is for, and when it can be used. The JWT claims and their meanings are defined in RFC 7519; which ones are required depends on the application.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
| Field | What it can tell you | What to compare |
|---|---|---|
alg |
The algorithm identified by the token header. | Whether the service explicitly permits it. The token itself must not be allowed to choose an algorithm outside the service’s policy. |
kid |
A key identifier, when present, that can help select a verification key. | Whether it maps to a key in the trusted key set for the expected issuer. |
iss |
The claimed issuer. | Whether it matches the issuer the service trusts and the source of the verification key. |
sub |
The claimed subject, often the identity the token represents. | Whether it is present and acceptable under the application’s rules. |
aud |
The intended audience or recipient. | Whether the receiving API is an intended audience. |
exp |
The time after which the token must not be accepted, subject to the implementation’s clock-skew policy. | Whether the token is expired according to the service’s clock and allowed skew. |
nbf |
The time before which the token must not be accepted. | Whether the token is being used too early under the service’s time policy. |
iat |
The time the token was issued. | Whether it is plausible and permitted under application-specific rules. |
| Scopes or other application-specific claims | Permissions or additional information interpreted by the service. | Whether the required claims are present and grant the operation being attempted. |
These values are useful clues, not proof. A token can display a plausible issuer, subject, or permission while still having an invalid signature or failing an application rule.
Why is my JWT not working?
Use the failure message and decoded claims to narrow the search, then confirm the cause with the application’s validator. The token’s intended profile—not a generic checklist—determines which claims and rules apply.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
- Expired token:
expis the expiration time. A service must not accept the token at or after that time, though its configured clock-skew policy can affect boundary handling. Check the value against the receiving service’s clock and time settings. - Audience mismatch: The token may be intended for a different API, or the token issuer and service may be configured with different audience values. RFC 8725 recommends checking the audience when a JWT could be intended for multiple relying parties.
- Issuer or key mismatch: The asserted issuer and the trusted verification key must belong together. RFC 8725 says keys used for cryptographic operations must belong to the asserted issuer; if they do not, “the application MUST reject the JWT.” See the IETF’s RFC 8725.
- Algorithm rejected: A token can name an algorithm the service does not allow. The verifier’s configured algorithm policy must govern; do not accept whatever algorithm appears in an untrusted header.
- Not-yet-valid or implausible timing: Check
nbf,iat, the service clock, and its time policy. Small clock differences can matter at token time boundaries. - Authorization claim missing: The signature and standard claims may pass, but the token may lack a scope or application-specific claim required by the endpoint.
- Wrong token type or format: An encrypted, nested, or otherwise different token form may not match what the endpoint expects. Confirm the endpoint’s token profile rather than assuming every JWT is a three-part signed token.
Does decoding a JWT verify it?
No. Decoding reveals data encoded in the token; it does not prove that the token was issued by a trusted party, remained unchanged, or is acceptable to the API. A signed JWT’s claims are not necessarily secret, so treat real tokens as sensitive even when their payload looks readable. JWTs can also be integrity-protected or encrypted, and those forms have different security properties.
A valid signature alone is not enough, either. The service must still check that the token is intended for it and satisfies the relevant time, issuer, subject, scope, and application-specific rules. RFC 8725, the IETF’s February 2020 Best Current Practice for JWTs, explains that each application defines the claims and validation rules required by its JWT profile.
Rank #3
How do I validate a JWT signature safely?
Use the validation path already established by the application: a maintained JWT library or framework middleware configured with trusted keys and explicit policy. Auth0’s JWT validation documentation strongly recommends middleware or an existing open-source third-party library to parse and validate JWTs.
- Obtain verification keys from the configured trusted issuer source. Do not trust a key merely because the token points to it; confirm that the key belongs to the issuer the application accepts.
- Configure the accepted algorithm or algorithms in the validator. Reject tokens that specify an unapproved algorithm.
- Validate the signature and registered claims according to the service’s profile, including issuer, audience, and time claims where required.
- Apply application authorization checks for required scopes, roles, subject constraints, token type, or other claims.
- Return and log specific validation failures safely. Record a failure category or claim name when useful, but avoid exposing or retaining the full bearer token.
Do not use a decoded browser display as the enforcement decision in production. The service receiving the request must perform the validation with its trusted configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which JWT tool should I use?
Choose by purpose: a browser debugger helps a person inspect a token, while a library or middleware enforces the receiving application’s policy. These are complementary roles, not interchangeable products.
| Tool category | Best use | Trusted-key and policy control | Fit with the service |
|---|---|---|---|
| Browser-based visual debugger, such as jwt.io’s debugger | Quickly inspect decoded headers and claims during development; it also offers an optional signature-verification workflow. | Useful for debugging, but the display does not establish that the receiving service trusts the key, permits the algorithm, or accepts the claims. | Independent of the service’s runtime configuration; do not use it as production enforcement. |
| JWT library or framework middleware used by the application | Parse and validate tokens on the server as part of request handling. | Can apply the trusted keys, allowed algorithms, claim checks, and application rules configured for that service. | Should match the application’s framework and its actual token profile. |
There is no universal token profile to copy from a debugger. The IETF’s RFC 8725 frames the core point: each application defines its required and optional claims and the rules used to validate them.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
