JWT Decode vs Verify: What the Claims Can Tell You
Decoding a JWT reveals readable data. Verification checks whether the signature is valid under a trusted key and allowed algorithm; your application must also enforce its claim rules. A token can decode perfectly and still be forged, expired or intended for another service. Flekify decodes tokens; it does not verify them.
Read the three segments
A compact signed JWT has header, payload and signature segments separated by dots. The header and payload are Base64url-encoded JSON objects. Base64url uses a URL-safe alphabet and often omits padding; it is not encryption. The signature segment is not a third JSON document. Encrypted tokens use a different format that this decoder does not support.
Inspect a test payload
Use a token from an environment you control. Inspect sub for the subject, iss for the issuer, aud for the intended audience and exp for expiry when those claims are present. Their names explain their intended roles, not whether the values are correct. The following is illustrative JSON, not a signed token or a recommendation for real claim values.
{
"sub": "test-user",
"iss": "https://issuer.example",
"aud": "example-api",
"exp": 1700000000
}Interpret time claims carefully
JWT NumericDate values use seconds since the Unix epoch, while JavaScript Date expects milliseconds. Multiply a NumericDate by 1,000 when inspecting it in JavaScript. exp describes expiry, nbf a not-before time and iat an issued-at time. Flekify can display these timestamps, but your browser clock may differ from the server and a displayed future expiry says nothing about signature validity.
Verify in the application that trusts the token
Use the authentication library and trusted key configuration for your application. Restrict allowed algorithms, select keys from a trusted issuer configuration and check audience, issuer and relevant time claims. Do not fetch an arbitrary key URL solely because an untrusted token asks you to. Never authorize a request by parsing the payload alone or by checking that a signature segment exists.
Keep inspection separate from sharing
Bearer tokens can grant access to accounts even if their payload looks harmless. Prefer test tokens and do not publish live tokens in screenshots, issue reports or URLs. Flekify's decoder processes the value locally, but a shared device or browser extension can still expose data. Use JSON Formatter for a non-sensitive payload you have already extracted; the plain Base64 decoder is not a JWT verifier.