Yesterday, 01:46 PM
A JWT is three base64url parts separated by dots: header.payload.signature.
To see what's inside without touching your server:
Check the important claims: exp (expiry), iss (issuer), aud (audience), and any scopes/roles.
⚠️ Never paste a production token into an online "JWT decoder" – you're handing your session to a stranger's server. If you need a quick check, our JWT Inspector on tools.php decodes 100% in your browser (WebCrypto – nothing leaves the page).
What do you usually find in your tokens – and has one ever expired mid-request at the worst possible moment?
To see what's inside without touching your server:
Code:
const payload = token.split('.')[1];
const decoded = JSON.parse(atob(payload.replace(/-/g,'+').replace(/_/g,'/')));Check the important claims: exp (expiry), iss (issuer), aud (audience), and any scopes/roles.
⚠️ Never paste a production token into an online "JWT decoder" – you're handing your session to a stranger's server. If you need a quick check, our JWT Inspector on tools.php decodes 100% in your browser (WebCrypto – nothing leaves the page).
What do you usually find in your tokens – and has one ever expired mid-request at the worst possible moment?