Secrets and encoding

How to tell that a decoded JWT was not verified

Someone wants to treat a decoded role claim as authorisation. Decode it on JWT Decoder.

Ben Fidge · Oct 2026 · 4 min read

What to run

Open JWT Decoder. It stays in the browser.

A successful decode means the segments were valid Base64url JSON.

It does not mean alg was honoured or the signature matched.

none in the header is a warning, not a pass.

Do not chain into Hash Generator to check the signature. HMAC verification needs the secret, which this tool does not ask for and should not.