Decoding a JWT is not verifying it

A JWT looks official because it is structured. Header and payload are just JSON, encoded with URL-safe Base64. Anyone can create those two parts. The signature is the only piece that can prove an issuer signed the token — and only if you check it with the right key.

What decoding does

Decoding splits the three segments, Base64url-decodes the first two, and parses JSON. You can read claims such as sub, exp, and alg. That is debugging. It is not login.

What verification does

• Recompute the signature with the issuer’s key or JWKS
• Reject alg: none and algorithm confusion tricks
• Enforce exp, nbf, aud, and iss according to your application

Alphzen’s JWT Decoder stops at the first job and says so on the page. A payload that looks like your user is not evidence that your server issued it.

Practical habit

Use the decoder to inspect a failing token’s claims. Verify on the server that owns the key. Do not paste production access tokens into a shared screen if you can use a fixture instead.