How to inspect JWT tokens safely

A JWT is three segments

Most signed JWTs contain a Base64URL-encoded header, a Base64URL-encoded payload and a signature separated by periods. The first two segments are readable, not encrypted.

Decoding is not verification

A decoder can display claims but cannot prove who issued them. Verification must check the signature, allowed algorithm, issuer, audience and time-based claims with trusted key material.

• Never grant access based on decoded text alone
• Reject unexpected algorithms
• Check exp and nbf
• Avoid pasting production tokens into server-backed websites

Debug with minimal exposure

Use short-lived development tokens, redact identifiers in screenshots and prefer a local browser decoder when a real token must be inspected.