guides

Decode JWTs inline

See the claims inside JSON Web Token cookies right in the extension — no external decoder site, nothing leaves your browser.

How it works

When a cookie’s value looks like a JSON Web Token — three base64url segments separated by dots — SessionCourier flags it with a JWT badge in the cookie list. Open that cookie and its header and payload are decoded inline in the editor, right below the value field. No copying the value into a decoder website, no browser console gymnastics.

Reading the claims

A decoded token shows the header first, then the payload:

{
  "alg": "HS256",
  "typ": "JWT"
}
{
  "sub": "user-4711",
  "iat": 1784800000,
  "exp": 1784803600,
  "role": "qa-tester"
}

The claims you’ll reach for most while debugging:

Claim	Meaning
`exp`	Expiry, as Unix time — when the token stops being valid
`iat`	Issued at, as Unix time
`sub`	Subject — usually the user or account the token is for

Practical tip: when a site bounces you to the login page in a loop, check the session token’s exp claim first. SessionCourier renders the exp, iat and nbf timestamps as readable local times and flags an exp that’s already in the past — a quick way to spot the token that looks fine but is simply expired.

Privacy and a caveat

Decoding happens entirely locally in your browser. The token never leaves it — unlike pasting a production session token into an online decoder.

Decoding is not verification. SessionCourier shows you what the token claims; it does not check the signature. Never treat a decoded token as trusted input — anyone can craft a token with arbitrary claims.