A token’s claims as a table

A user reports that they cannot issue refunds, and the support ticket includes the access token their session was using. Somewhere inside it is the answer: a list of what the token allows. Reading that list out of a base64 string is not a job for a person, and pasting a live token into an online decoder is not a job for anyone. This recipe decodes it in your browser, carries the payload to the editor, and turns the permissions into a small table you can paste straight back into the ticket.

1 · Take the payload out of the token

The decoder splits the token into its header, its payload and its signature, and shows the first two as JSON. You do not need the key to do that; the key is only for checking the signature, which this job does not ask about.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c2VyLTc3MzAiLCJuYW1lIjoiSW5lcyBEdWFydGUiLCJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJwZXJtaXNzaW9ucyI6W3sicmVzb3VyY2UiOiJvcmRlcnMiLCJhY2Nlc3MiOiJyZWFkIn0seyJyZXNvdXJjZSI6InJlZnVuZHMiLCJhY2Nlc3MiOiJ3cml0ZSJ9LHsicmVzb3VyY2UiOiJyZXBvcnRzIiwiYWNjZXNzIjoicmVhZCJ9XSwiaWF0IjoxNzY3MjI1NjAwfQ.zkAVahqdlia79Bh22s1W7GemuLKF-stOR1F01w4h3yE

{
  "sub": "user-7730",
  "name": "Ines Duarte",
  "iss": "https://auth.example.com",
  "permissions": [
    {
      "resource": "orders",
      "access": "read"
    },
    {
      "resource": "refunds",
      "access": "write"
    },
    {
      "resource": "reports",
      "access": "read"
    }
  ],
  "iat": 1767225600
}

That is the document the button hands to the editor: every claim the token carries, written with the indent from Settings. The subject and the issuer say whose token it is and who signed it, iat says when, and there is no exp — this token never expires, which is worth mentioning in the ticket in its own right. The part you came for is permissions, an array of three objects.

Nothing about the token is sent anywhere, and the decoder stores nothing: close the tab and the token is gone. The payload that arrives in the editor is an ordinary document from then on, kept with the tab like any other, so clear it when you are done if the claims are sensitive.

2 · Read the permissions as a table

The payload arrives in the editor’s left pane as it left the decoder. The Table view turns any array of objects into rows and columns, and it can drill from the payload into the one array that matters.

{
  "sub": "user-7730",
  "name": "Ines Duarte",
  "iss": "https://auth.example.com",
  "permissions": [
    {
      "resource": "orders",
      "access": "read"
    },
    {
      "resource": "refunds",
      "access": "write"
    },
    {
      "resource": "reports",
      "access": "read"
    }
  ],
  "iat": 1767225600
}

| resource | access |
| -------- | ------ |
| orders   | read   |
| refunds  | write  |
| reports  | read   |

One row per permission, a column per key. Refunds: write is there, so the token does grant refunds — the problem is somewhere else, and the ticket can say so with the evidence attached. Had the row been missing, or said read, the table would show that just as plainly.

The export writes the level the grid is showing, which is why the steps drill into permissions first; exported from the top, the table would be a key and a value per claim, with the whole array squeezed into one cell as a line of JSON. Markdown is padded so the columns line up in plain text too, and renders as a table in most ticket systems. Row labels are unticked, since the array positions mean nothing to the person reading the ticket.

Other tokens, other shapes

Not every provider lists permissions as objects. Many use a space-separated scope string, which is already readable as it is, or a plain array of role names, which the Table view shows as a single column. Some nest their claims under a namespaced key, such as a URL; drill into that object first, then into the array inside it. The export follows wherever you are.

If you do need to know whether the token is genuine — say the ticket suggests someone has been editing tokens by hand — the decoder checks the signature too, given the secret or the public key. For a token like this one, whose secret was never published, no key you could type will make it say the signature is valid.

Keeping it tidy

CSV is the other choice worth knowing. Pick it in the export card when the permissions are going into a spreadsheet rather than a ticket, and the same rows arrive with a header line and commas. Both choices are kept for the next export, so check the format before you press Download again later. The card’s own title says which level it will write: it reads Export permissions once the grid has drilled into the array.

Where to go from here

• Open the payload in the editor, and the rest of the JWT decoder section.
• The Table view and its export: drilling, ragged rows and each format.
• Verify an HS token with its secret, when the question is whether to trust it.

Open the JWT decoder with your own token, or Open the editor if you already have the payload.