How JWTs Work and How to Decode Them
Understand JWT structure and the difference between decoding and verification.
A JWT has three parts
A JSON Web Token normally contains a header, payload, and signature separated by dots. The first two parts are encoded representations of JSON data.
Decoding is not verification
Anyone who has a JWT can decode its header and payload. That does not prove the token was issued by a trusted party or that its signature is valid.
Handle secrets carefully
Do not paste production credentials or sensitive tokens into a tool unless you understand exactly how the tool processes them. Client-side processing does not make an exposed credential safe to disclose.