Reviewed 2026-08-28

JWT Inspection Without Trusting Unverified Claims

Decode headers and claims for debugging while keeping verification separate.

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.signature

Header: {"alg":"HS256"}
Claims: {"sub":"1234"}

Reproducible method

1. Preserve the original and create the smallest representative sample.
2. Run a strict parse or validation before transformation.
3. Record options, compare counts and structure, then test in the receiving system.

Common error

Readable claims are often mistaken for verified identity.

Reduce a failure while retaining the problematic structure; this separates malformed input from unsupported behavior.

Technical limitation

Decoding does not verify signature, issuer, audience, expiry, or trust.

A successful preview does not remove format ambiguity or downstream requirements.

Security and privacy

Treat bearer tokens as credentials and authorize only after backend verification.

Local processing reduces transfer risk but cannot protect a compromised browser, unsafe extensions, clipboard history, or later misuse.

Verification checklist

• Check field, record, page, or byte counts.
• Review edge cases and error output.
• Retain the original until acceptance.
• Document assumptions for automation.

Open the related tool