How to Validate JWT Tokens — Developer Guide

JWT validation is essential for secure authentication. Whether you're debugging a login flow or inspecting token claims, this guide walks you through decoding, checking expiration, and understanding what validation actually means.

Decode vs Validate — Know the Difference

Decoding — reading the header and payload (Base64 decode). Anyone can do this.
Validating — verifying the signature + checking claims (exp, iss, aud). Requires the secret/public key.

Our JWT Decoder decodes tokens for development and debugging. It does NOT verify signatures. Always validate server-side in production.

Step 1: Decode the JWT

Copy the JWT from Authorization header, cookie, or API response
Paste into the JWT Decoder tool
Review the header — check algorithm (alg) and token type
Review the payload — inspect claims like sub, email, roles, exp

Decode JWT Token Free

Instantly view header, payload, and expiration status.

Open Tool

Step 2: Check Expiration

The exp claim is a Unix timestamp indicating when the token expires. Our decoder shows expiration in human-readable format with valid/expired status. If expired, the client needs to refresh the token or re-authenticate.

Convert JWT exp Timestamp

Convert Unix timestamps to readable dates.

Open Tool

Step 3: Verify Claims

Check iss (issuer) matches your authentication server
Check aud (audience) matches your application
Verify sub (subject) is the expected user ID
Inspect custom claims (roles, permissions) for authorization
Ensure token hasn't expired (exp > current time)

Step 4: Verify Signature (Server-Side)

Signature verification must happen on your server using the secret key (HS256) or public key (RS256). In Node.js, use jsonwebtoken library: jwt.verify(token, secret). Never expose your secret key to the client.

const jwt = require('jsonwebtoken');
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
  console.log('Valid token:', decoded);
} catch (err) {
  console.log('Invalid token:', err.message);
}