JWT Anatomy: Header, Payload, Signature — and Why Decoding Is Not Verifying
The three Base64url segments of a JSON Web Token, standard claims, signature algorithms, and safe debugging practice.
Three segments
A JWT is header.payload.signature, each segment Base64url-encoded (signature is raw bytes). The decoder shows header and payload so you can inspect exp, iat, sub and custom claims.
Decode ≠ verify
Anyone can read and re-forge the payload; only the signature proves authenticity. Debugging tools never check signatures because the secret lives server-side. Never trust a decoded token in production code without verification.
alg pitfalls
The historical "alg: none" and RS256→HS256 confusion attacks came from trusting attacker-controlled headers. Modern libraries pin the algorithm — do the same in your verifier.