You've got a JWT and you need to see what's inside it — which user it's for, what scopes it carries, when it expires. The quick move is to search "jwt decoder," grab the first result, and paste your token in. Don't. A JWT is often a live credential, and decoding one is so simple you never need to hand it to a stranger's server. Here's how it actually works.
A JWT is just three Base64 strings
A JSON Web Token is three Base64-encoded parts joined by dots:
header.payload.signature
Enter fullscreen mode
