CheckcraftDecode a JWT online: expiry, payload and signature
Checkcraft is a desktop app for checking APIs and logs without code, with a free edition. Download, no sign-up →
Getting 401 with what looks like a fresh token? Decode it: the payload shows expiry, issuer and audience, and the cause is usually right there.
How a JWT is built
A token has three dot-separated parts: header, payload and signature. The first two are base64url-encoded, not encrypted, so anyone holding the token can read them. The signature proves the data was not changed, and only someone with the secret or public key can verify it.
Why a server returns 401 for a token that looks fine
The usual causes: exp has passed; nbf says the token is not valid yet; server and client clocks differ; aud or iss is not what the server expects; the token was signed with another key, for example from a different environment. Compare the decoded fields with what the API expects.
Security
A token grants access until it expires. A script in your browser does the work; the page sends nothing to a server. Still, avoid pasting live production tokens and do not share them in chats.
Repeat this on your own API
Checkcraft is a desktop app that saves API response checks without code and shows what did not match. Start with a sample, then use your own sanitized data. Free runs on Windows and Linux with no time limit.
Download FreeDownload and first runNo sign-up or email needed, the archive is ready in a couple of minutes. See the edition limits.
References
Start with the linked example and compare its result with your own test requirement.