What a JWT contains
A compact JWT normally has a header, payload, and signature separated by periods. The first two sections are encoded JSON and are readable by anyone who has the token.
Decoding is not verification
This tool does not check the signature, issuer, audience, expiration, or key. Never trust a token merely because its JSON decodes successfully.
Sensitive claims
JWT payloads are not encrypted by default. Avoid placing passwords, API keys, or unnecessary personal information in claims.