How to decode a JWT locally without exposing the token

⌚ About 2 min read

Read a JWT header and payload for troubleshooting while remembering that decoding never validates the signature.

Before you start

Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.

Step by step

Remove or mask the token from public tickets and screenshots.
Paste the JWT into the BAOI JWT Decoder, which runs locally.
Check alg, kid, iss, aud, exp, nbf, and relevant claims.
Compare issuer and audience with the application configuration.
For any security decision, cryptographically verify the signature in the application.

Validation

Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.

Technical deep dive

JSON / JWT: valid syntax does not mean trusted data

Technical checkpoints

JSON requires double quotes for strings/keys and standard JSON allows neither comments nor trailing commas.
A JWT is three base64url segments header.payload.signature; decoding header/payload does not verify the signature.
Claims exp, nbf, iss and aud must be interpreted in the context of issuer and signing key.

JWT example

Decode locally for inspection only; never paste a real token into a third-party service.

header.payload.signature
# Base64URL != standard Base64: -/_ and padding can differ

Topic-specific pitfalls

Well-formatted JSON can still be semantically invalid for the target API.
Seeing alg=none or an unexpected algorithm without checking validation policy is a security warning.

How to validate

JSON is validated by the parser and, when available, by the expected schema.
A JWT is considered valid only after cryptographic verification plus issuer, audience and temporal claims checks.

Operational context

A JWT can be decoded locally because its header and payload are Base64URL-encoded, but decoding is not signature verification. Avoid pasting production tokens into third-party websites and inspect claims locally before any trust decision.

Step-by-step checks

Treat the JWT as a credential: copy it only to a trusted local environment and remove it when analysis is complete.
Decode header and payload locally and inspect alg, kid, iss, aud, sub, exp, nbf and relevant application claims.
Check timestamps against the correct clock and expected issuer/audience values.
For authenticity, verify the signature with the trusted issuer key/JWKS and enforce the expected algorithm rather than trusting the header alone.

How to validate the result

The token is acceptable only when its signature verifies with a trusted key and issuer, audience and time-based claims satisfy the application policy.

Evidence to keep

Record only non-sensitive claim names/validation results, issuer/key identifier and verification error. Do not put the raw production JWT in tickets or BAOI diagnostics.

Frequently asked question

If I can decode a JWT, does that mean it is valid?

No. Anyone can construct decodable header/payload data. Trust requires cryptographic signature verification plus claim validation.

Related BAOI resources: IT tools · procedures · IT dictionary.