Why is my JWT rejected?
A rejected token usually fails on one specific claim, and the error your server returns rarely says which. Decoding it locally answers the question in a second.
The most common answer is that it expired, and the second most common is a clock difference between the machine that issued it and the machine checking it.
A worked example
The verdict below is produced by running the verifier on this input — the same code the tool runs in your browser, not a description of it written alongside.
Token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTEwNDIiLCJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJhdWQiOiJhcGkiLCJpYXQiOjE3ODg0MzMyMDAsImV4cCI6MTc4ODQzNTkzOH0.w_tqWSUp42LKNes3AjLSue_mWXwlkKBtoKvqq7XLRu0
Checked at
2026-09-03T12:00:00.000Z
This link does not carry the token. Tokens are treated as secrets everywhere on this site and are never put in a URL, not even a synthetic one — use “Load an example” in the tool to get exactly the token above.
What this checks
- Whether exp has passed and by how much, and whether nbf is still in the future.
- Whether the header says alg: none, which means the signature is decorative.
- Whether iss and aud match the values your service expects, when you supply them.
- The HMAC signature itself, if you paste the shared secret — computed in the page, never sent anywhere.
What it does not tell you
- That the token is genuine, unless you supply the key. Decoding is not verifying: anyone can read a JWT, and the signature is the only part that establishes it was not forged.
- That your server will accept it. Servers add their own rules — required scopes, revocation lists, key rotation — that a decoder cannot see.
Questions
Is my token sent anywhere?
No. Decoding and signature verification both run in your browser. The token is never uploaded, never written into a share link, and never stored in your verification history — that entry records only the verdict.
What does "alg: none" mean?
It means the token declares that it has no signature. A verifier that honours the header will accept anything, which is why alg:none is reported as an error rather than a warning.
The token looks valid but my server disagrees.
Check the clock on both machines first — a token that expired seconds ago on one is still valid on the other. After that, the usual causes are an audience or issuer mismatch, or a key that has been rotated.
Related
Everything runs in your browser — nothing you paste is uploaded. Read more about local processing or this verifier in the docs.