Developer · THE NO-PANIC PLAN
Inspect a JWT without mistaking decoding for verification
JWT headers and claims can be readable even when the token is signed. Decoding is not signature validation or proof of authorization. Use only a synthetic, non-secret token in a browser tool, then verify the actual issuer, audience, algorithm, profile and time claims in the real relying service.
MISSION Understand a JWT test token?s structure while preserving the security checks required by its consuming application.
Open the token issuer?s current metadata and validation profileTHE REAL-WORLD BIT
What happens outside this browser tab?
Identify token type, issuer and consumer; inspect only a synthetic value; use a local decoder for structure if useful; verify cryptography and profile claims with the consumer?s trusted configuration; then resolve failures without logging or exposing credentials.
YOUR CHECKLIST, WITH FEWER DRAMATIC SIGHES
One step at a time.
Follow the order below. If a step names a Nirmion tool, its link is right there with it.
- 01
Identify the token profile and decide whether it is safe to inspect
Determine whether the value is intended to be a signed JWS, encrypted JWE, OAuth access token, ID token or another application-specific profile. Record the issuing service, receiving service, expected audience, purpose and the issuer?s authoritative metadata/key-discovery source. A compact token may contain readable personal or authorization claims even when it is signed. Never paste a live bearer token, refresh token or production credential into a browser tool, ticket, screenshot or chat. If a token may have been exposed, follow the issuer?s revocation/rotation process instead of continuing to inspect it.
- 02
Decode only a synthetic or explicitly approved test token
For a non-production test value with no authority, inspect the protected header and claims to understand the token?s structure. A readable header/payload is only decoded data: it does not prove that the signature is valid, that the claims are trustworthy, or that the token is intended for your service. Note the token type and `alg`/`enc` values, but never let an untrusted token choose the verifier?s accepted algorithm or keys. If the value is an encrypted JWE, a generic decoder may not reveal claims without the correct authorized decryption key.
- 03
Use a browser-local decoder only for non-secret examples
Nirmion?s browser-local JWT Decoder can display a test token?s readable header and payload claims without claiming signature verification. Use a fabricated fixture or an issuer-provided non-production sample; do not enter real credentials, personal claims or customer tokens, even in a client-side tool. Confirm the tool?s current processing behavior and clear the input after review. Record only the specific test claim or structure needed for debugging. Do not treat decoded `iss`, `sub`, `aud`, role or expiry values as proof of identity or authorization.
- 04
Verify cryptography and claims with the actual relying service
The application must validate the signature or authenticated encryption using keys obtained through the configured trusted issuer relationship, enforce a fixed algorithm allow-list, and reject invalid cryptographic operations. Validate issuer and audience against the exact service, token type/profile, expiry and not-before times, and all claims required by that application. Check key rotation, accepted audiences/scopes and clock-skew policy using the issuer?s current documentation. RFC 7519 does not make every claim mandatory in every deployment; the provider?s profile and RFC 8725 security guidance govern the checks. Decoding or checking an expiry timestamp is not verification.
- 05
Handle failures without exposing or trusting the token
If parsing fails, use a synthetic fixture to isolate malformed encoding/JSON from signature, key, issuer, audience or time-validation failures. Redact the complete token from application logs and diagnostics; do not copy only the payload into a public issue because claims can still be sensitive. If a live credential was disclosed, revoke or rotate it with the issuer and review authorized audit logs. Preserve a non-secret regression fixture and test both accepted and rejected cases in the consuming service?s library. Ask the issuer/security owner to confirm unexpected profile behavior; do not manually edit claims or relax verification to make a token pass.
THE HELPER CREW
Tools for the fiddly bits.
These are the currently published Nirmion tools matched to this guide. Open a tool page for its accepted inputs and limits.
RECEIPTS, PLEASE
Sources & review notes
Each source is linked to the steps it supports. Open it to check its scope and current guidance.
Source checked 2026-10-06