FIELD NOTES
Reading a JSON Web Token
A JWT normally contains Base64URL-encoded header, payload and signature segments. The payload often carries claims such as issuer, subject and expiration.
Decoding is not signature verification. Never treat displayed claims as trusted until a server verifies the signature and expected algorithm.