A JWT is three segments
Most signed JWTs contain a Base64URL-encoded header, a Base64URL-encoded payload and a signature separated by periods. The first two segments are readable, not encrypted.
Decoding is not verification
A decoder can display claims but cannot prove who issued them. Verification must check the signature, allowed algorithm, issuer, audience and time-based claims with trusted key material.
- Never grant access based on decoded text alone
- Reject unexpected algorithms
- Check exp and nbf
- Avoid pasting production tokens into server-backed websites
Debug with minimal exposure
Use short-lived development tokens, redact identifiers in screenshots and prefer a local browser decoder when a real token must be inspected.
Put the guide into practice.
Open the private browser-based toolbox and convert a sample in seconds.