How to Decode, Verify & Debug JSON Web Tokens (JWT) Without Leaking Secrets

A JSON Web Token (RFC 7519) is a compact, URL-safe string composed of three distinct base64url-encoded parts separated by periods (`.`): `[HEADER].[PAYLOAD].[SIGNATURE]` 1. **Header:** Identifies the cryptographic algorithm used to sign the token (e.g. `HS256`, `RS256`, `ES384`) and token type (`JWT`). 2. **Payload (Claims):** Contains statements about an entity (typically the user) and additional metadata: - `sub` (Subject): Unique user ID or entity identifier - `exp` (Expiration Time): Unix timestamp after which the token is invalid - `iat` (Issued At): Timestamp when the token was created - `iss` (Issuer): Identity provider URI - `aud` (Audience): Target API recipient 3. **Signature:** Cryptographic verification hash calculated over the encoded header and payload using HMAC, RSA, or ECDSA.

JWT payloads are encoded, **not encrypted**. Anyone possessing the token string can decode the payload instantly using standard Base64 decoding. When developers paste active production session tokens or OAuth bearer tokens into cloud-hosted debuggers, those tokens are transmitted across public internet connections and may be captured in server access logs, analytics scripts, or third-party tracking pixels. A compromised token grants attackers the exact same access privileges as the authenticated user until the token expires.