JWT Claims Are Data; Signatures Establish Integrity

Decoding is not validation

A JSON Web Token commonly contains a header, a payload, and a signature, separated by periods. The first two parts use Base64URL encoding and may be decoded to inspect JSON. This is a representation, not encryption: anyone who has the token can usually read those fields.

Decoding alone does not prove that the token was signed by a trusted issuer. It also does not determine whether its issuer, audience, expiry, or other claims are acceptable for a particular application.

Validate in the system that relies on the token

Applications should verify the signature using a trusted key and an explicitly allowed algorithm, then validate the claims required by that application. Do not rely on values supplied by an unverified token.

CalcPool's local token inspector is intended for debugging readable parts. It does not validate signatures. Never paste production credentials into a tool unless your security policy permits it, and do not share live tokens in logs or screenshots.