Demo: inspect JWT header and claims
JWTs are easier to review when header, payload, and signature are separated. A diagram makes algorithm, issuer, audience, expiry, and custom claims visible.
- Check exp, nbf, iss, and aud before trusting a token.
- Treat decoded payload as readable, not secret.
- Never paste production tokens containing sensitive user data into public tools.
header.alg = RS256
payload.iss = https://auth.example.com
payload.aud = api
payload.exp = 1781760000