Check expiry first when debugging 401 errors
The most common cause of unexpected 401 Unauthorized errors in APIs is an expired JWT. Paste the token into the decoder and check the exp claim. If it is in the past, the token has expired and needs to be refreshed. The decoder shows expiry in human-readable format alongside the Unix timestamp and flags expired tokens with a red warning banner.
Verify the audience claim matches your API
JWTs intended for one service should not be accepted by another. The aud (audience) claim specifies which service(s) the token is valid for. If you are getting 403 Forbidden errors even with a valid, unexpired token, check whether the aud claim matches what your API expects. A token issued for api.example.com should not be accepted by admin.example.com unless the audience claim includes both.
Inspect the algorithm claim for security
The alg claim in the JWT header specifies the signing algorithm. The "none" algorithm (alg: "none") means the token has no signature — any payload is accepted. This is a critical security vulnerability if your server accepts tokens with alg: "none". The decoder flags this with a red warning. Always verify your server rejects tokens with alg: "none" and only accepts the specific algorithm(s) you intend to support.
Check role and permission claims when debugging 403 errors
A 403 Forbidden error means the user is authenticated (their identity is known) but not authorised (they do not have permission). Decode the JWT and look for role, scope, permissions, or similar custom claims. Compare what the token contains to what your endpoint requires. This immediately tells you whether it is a token issue (missing claim) or a server configuration issue (wrong claim name, wrong format).
Use iat to understand token freshness
The iat (issued at) claim tells you when the token was created. If a user reports an issue that started happening at a specific time, and the iat is before that time, the token was issued before the problem started — ruling out a login-time issue. If iat is after the problem started, something changed in the auth system since the user last logged in.