Can you trust a decoded JWT? Signatures and expiry claims

1. Inspect the token structure

A common signed JWT has header, payload and signature segments separated by periods. The first two contain Base64URL-encoded JSON. This decoder expects three segments; five-segment encrypted JWE input is outside its scope.

base64url(header).base64url(payload).signature

2. Read claims from the built-in demo

Open the JWT tool, load Example and decode it to inspect the header and payload. The JSON below is only an illustrative payload; do not paste it as a complete token.

The meaning expected for sub, iss and aud comes from your authentication system. Plausible-looking values still need server-side validation before they can authorize access.

{
  "sub": "demo-user",
  "iss": "https://example.com",
  "aud": "demo-api",
  "iat": 1788768000,
  "exp": 1788771600
}

3. Convert exp as seconds

NumericDate claims such as exp, iat and nbf use seconds since the Unix epoch. Convert 1788771600 with Seconds selected: expect 2026-09-07T09:00:00.000Z. In this example, exp is one hour after iat.

The actual verifier determines any permitted clock skew. Displayed dates help diagnose a problem but do not replace the authentication server’s acceptance decision.

4. Separate decoding from verification

Anyone can encode JSON claiming an administrator identity. The server must verify signatures with trusted keys and allowed algorithms, then validate issuer, audience, timing and application permissions. A token’s algorithm declaration is not itself a basis for trust.

5. Keep the right evidence when debugging

For an unauthorized response, record the status, request time and server error category, then compare exp with the server clock. Editing the payload or extending exp is not a valid fix for a real login and affects the signature.

• Keep successful decoding separate from a valid signature.
• Check seconds versus milliseconds and UTC versus local display.
• Remove live login tokens from shared debugging material and reproduce with demo data.