Decode first, trust later
A JWT decoder shows you the header and payload without proving the signature is valid. That is still invaluable when debugging auth — you can see expired timestamps, wrong audiences, and missing scopes in seconds.
Never paste production refresh tokens into a random online decoder. Prefer a local or client-side tool, and rotate anything that might have been exposed.
Checklist when a request returns 401
Work through these claims in order:
- exp / nbf — is the clock skew within tolerance?
- iss / aud — do they match what the API expects?
- alg — is the algorithm what your verifier allows (reject none)?
- scope / permissions — does the token grant the route you're calling?
- kid — does the key id resolve to a key your service still publishes?
Decode on code.live
The JWT Decoder on code.live inspects headers and payloads in your browser. Use it to confirm claim values, then verify signatures on the server where your signing keys live.