JWT inspector
Decode five tokens, verify their HS256 signatures against the lab server key, and see which checks a careful API runs before trusting a claim.
Goal
The API at api.contoso.example received five bearer tokens. Decode each one, then run the checks the API performs before it trusts a single claim.
The lab server signs with HS256 and a shared key, and its clock is fixed at 2026-03-14T09:00:00Z. You can edit any token in the box to see which check breaks.
Captured tokens
Lab clock
2026-03-14T09:00:00Z
Accepted values
alg HS256
iss https://auth.contoso.example
aud api.contoso.example
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"iss": "https://auth.contoso.example",
"aud": "api.contoso.example",
"iat": "1773478200 (2026-03-14T08:50:00Z)",
"exp": "1773481800 (2026-03-14T09:50:00Z)",
"sub": "u-1042",
"name": "Ana Ruiz",
"role": "analyst"
}Server checks
- passAlgorithm is HS256 (the only one this API accepts)alg is "HS256"
- passSignature matches the server keyHMAC-SHA256 matches
- passIssuer is https://auth.contoso.exampleiss is "https://auth.contoso.example"
- passAudience is api.contoso.exampleaud is "api.contoso.example"
- passToken has not expiredexp is 2026-03-14T09:50:00Z
- passToken is already valid (nbf)no nbf claim
Accepted. The API trusts sub u-1042 with role analyst.
Steps
01Which token passes every check?
02Token B claims role admin and has no signature. What should the API do?
03Token D has a valid-looking signature but fails. Which payload claim was changed?
04Token C expired how many hours before the lab clock (2026-03-14 09:00 UTC)?
05Token E is correctly signed by the same issuer. Why must this API still refuse it?