How to inspect a JSON Web Token's header and payload

1. Paste the JWT

   Drop the token into the "Token" field. JWTs look like `xxx.yyy.zzz` — three base64url segments separated by dots. The tool splits on dots and decodes the first two.

2. Press Run

   Result returns `header` (the algorithm and type, e.g. `{ "alg": "HS256", "typ": "JWT" }`) and `payload` (your claims — `sub`, `exp`, `iat`, plus app-specific ones). The third segment (signature) is NOT verified or shown.

3. What this isn't

   Decoding ≠ verifying. Anyone with the token can read its payload; what proves authenticity is the signature, which requires the secret/public key. Don't trust unsigned tokens — use jwt-encoder or your auth library to verify on a server you control.

4. Common claims worth checking

   `exp` is a Unix timestamp — expired tokens shouldn't be honored even if the signature is valid. `iss` should match your expected issuer. `aud` should match your service. If a token's payload looks fine but auth fails, the signature is wrong, not the claims.