A JSON Web Token can carry identity and access-related claims between systems. Reading its encoded fields can help troubleshoot a configuration, but decoding alone does not prove who issued it, whether it was changed, or whether an application should accept it.
A signed compact JWT commonly has three dot-separated pieces: a base64url-encoded header, a base64url-encoded claims payload and a signature segment. A compact encrypted JWE has five pieces and its payload is encrypted; this inspector does not decrypt JWE tokens. A readable payload is encoded, not confidential.
iss identifies an issuer, sub a subject, aud the intended audience, and exp, nbf and iat describe time claims in NumericDate form. Presence or plausible values are not enough: which claims are required and how they are interpreted depends on the receiving application.
A verifier must validate the JWS signature or MAC using the expected algorithm, trusted key and application policy. It must also check required issuer, audience, time and other claims. Never accept a token because a browser decoder displays expected values, and never trust the token's own header as the authority for choosing an algorithm or key.
Bearer tokens can grant access to whoever possesses them. Prefer synthetic or redacted examples. Do not paste a production token into shared devices, tickets, screenshots or chat; revoke or rotate an exposed credential through the issuer's approved process. A local browser tool does not make a sensitive token safe to disclose.
It accepts one compact three-part token up to 16 KiB and displays selected header and payload fields locally. It does not send or save token text. It does not verify the signature, cryptographically validate the token, decrypt encrypted tokens, contact an issuer, check application policy or establish that access should be granted. Treat all displayed claims as untrusted input.
Use a synthetic or approved non-production sample and review its claims locally. For an access failure, validate the token and application policy with your identity provider's supported tools and trusted keys.
See RFC 7519, JSON Web Token for token and claims structure, and RFC 7515, JSON Web Signature for signature validation requirements. These references do not replace the policy of the application that consumes a token.
