JWT / Token Decoder Guide
This JWT / Token Decoder Guide shows how to decode a JSON Web Token header and payload in the browser, review alg, exp, aud, and iss, and keep signature verification on the server. It is not a CSRF token, anti-CSRF token, or CSRF token mismatch debugger — those are form-protection secrets, not JWTs.
Overview
A JSON Web Token has three Base64url parts: header, payload, and signature. Decoding the first two is useful for troubleshooting, but anyone can craft a payload. Signature verification must happen on the server with the correct secret or JWKS key. If you arrived looking for a CSRF token explainer, a CSRF token mismatch fix, or an anti-CSRF token generator, this page is the wrong tool — it only decodes JWTs you already have.
What to inspect
- Algorithm: Reject tokens using none or unexpected signing algorithms.
- Expiry: Review exp and nbf to confirm the token lifetime matches policy.
- Audience and issuer: Validate aud and iss before trusting authorization decisions.
Important JWT claims
| Claim | Meaning | Review focus |
|---|---|---|
| alg | Signing algorithm | Must not be none in production |
| exp | Expiration time | Should be short-lived for access tokens |
| aud | Audience | Must match the intended service |
| iss | Issuer | Must match your trusted identity provider |
Safe inspection workflow
Decode the JWT locally, inspect alg/exp/aud/iss, then verify the signature on the server with the correct secret or JWKS key.Recommended Remediation Flow
- Decode locally Paste the JWT into Vulnify’s free decoder in this browser. The header and payload stay on your device.
- Verify server-side Never trust decoded payload data until the signature is validated on the server.
- Reject risky algorithms Block none and unexpected alg values at verification time.
- Treat tokens as secrets Do not paste production tokens into third-party websites.
Troubleshooting Common Issues
Decoded payload looks valid but API rejects token
The signature or claim set may still be invalid.
- Check clock skew against exp and nbf.
- Confirm aud and iss match server expectations.
- Verify the signing key or JWKS endpoint.
Validation Checklist
Post-fix validation
- Signature verification happens on the server.
- none is rejected.
- Token lifetimes and audiences match policy.
FAQ
Is this a CSRF token decoder?
No. This JWT / Token Decoder Guide decodes JSON Web Tokens. It does not inspect CSRF tokens, anti-CSRF tokens, or CSRF token mismatch errors.
- A CSRF token is a form-protection secret, usually a random value bound to a session cookie.
- A JWT is an API or session credential with a header, payload, and signature.
- If you have a CSRF token mismatch, check the form token, cookie SameSite flags, and server session — not this decoder.
What is a CSRF token, and why is it not a JWT?
A CSRF token (sometimes called an anti-CSRF token) proves a browser request came from your own form. It is not the same as a JWT.
- CSRF tokens are typically hidden fields or headers compared against a session value.
- JWTs carry claims such as iss, aud, and exp and are verified with a signature.
- Use this guide only when you have a three-part JWT to inspect locally.
How do I use this JWT / Token Decoder Guide?
Open the free JWT / Token Decoder, paste a token you are authorized to inspect, and review alg, exp, aud, and iss. Then verify the signature on the server.
- Decoding is not verification.
- Anyone can craft a Base64 payload.
- Only signature validation proves integrity.
Is this JWT / Token Decoder Guide free?
Yes. The guide and the decoder Quick Check are free and need no signup. A full OWASP scan on Vulnify needs Get Started and starter credits.
- Decoding runs in the browser.
- Do not paste production tokens into third-party sites.
- Keep signature checks on your API server.
Can I trust a decoded JWT?
Not by itself.
- Decoding is not verification.
- Anyone can craft a Base64 payload.
- Only signature validation proves integrity.