jwtread jwt tokenauthenticationsecurity
How to Read a JWT Token Safely
Understand JWT headers, payload claims, expiration, and the limits of decoding without verification.
August 28, 2024·6 min read
JWT Structure Refresher
A JWT has three parts:
- Header
- Payload
- Signature
The first two sections are usually Base64URL-encoded JSON.
What You Can Learn From a Token
- Issuer and audience
- Subject or user ID
- Expiration
- Roles or scopes
- Issued-at time
What Decoding Does Not Do
Decoding is not verification. You can inspect a token without proving it is trustworthy.
Use JWT Parser to inspect claims and Epoch Converter to interpret iat and exp values.