Debugging JWTs: How to Read, Validate, and Stop Blindly Trusting Tokens

The first time I had to debug a JWT authentication issue, I stared at the token string for ten minutes before realizing I could just decode it and read the contents. JWTs are not encrypted by default. They are signed, which means anyone can read them, but only the holder of the secret key can create valid ones. That distinction is the single most important thing to understand about JWTs, and getting it wrong leads to real security vulnerabilities. The three parts A JWT is three Base64URL-encoded strings separated by dots: eyJhbGciOiJIUzI 1 NiIsInR 5 cCI 6 IkpXVCJ 9 .eyJzdWIiOiIxMjM 0 NTY 3 ODkwIiwibmFtZSI 6 Ik 1 pY 2 hhZWwiLCJpYXQiOjE 3 MTYyMzkwMjJ 9 .SflKxwRJSMeKKF 2 QT 4 fwpMeJf 36 POk 6 yJV_adQssw 5 c Header (first part): Contains the signing algorithm and token type. { "alg" : "HS256" , "typ" : "JWT" } Payload (second part): Contains the claims -- the actual data. { "sub" : "1234567890" , "name" : "Michael" , "iat" : 1716239022 } Signature (third part): The cryptographic signature