A JWT can be read without being trusted. Verification requires the correct key, algorithm policy, issuer, audience, and application rules.
Treat the payload as untrusted until a…
Treat the payload as untrusted until a server-side verifier checks the signature and token policy. A base64url decoder cannot detect tampering.
Reject algorithms and issuers that are not…
Reject algorithms and issuers that are not part of the application’s explicit policy. Validate expiry, not-before, audience, and subject claims where they matter.
Never paste a live bearer token into…
Never paste a live bearer token into a public website. Use a redacted or synthetic token for documentation and debugging.
Use the related tool carefully
This guide is paired with a browser-only utility. The tool is a practical aid for small examples and inspection; it is not a substitute for application testing, a formal data pipeline, or professional review where the decision has higher consequences.
Open the related JWT Payload Decoder