A JSON Web Token often contains a readable header and payload encoded with Base64URL. Decoding only reveals those fields; it does not verify the signature, validate claims, or prove that the token is authentic.
Inspect claims without trusting them
Treat decoded claims as untrusted input until the token's signature and expected issuer, audience, and expiry are verified by the service that owns the signing keys.
- Use a test or non-sensitive token when possible.
- Decode the header and payload.
- Review fields such as issuer, audience, and expiration as clues only.
- Verify the signature with the correct trusted key in the appropriate backend.
Keep in mind: Never share a live bearer token: anyone with it may be able to act as its holder until it expires or is revoked.