Every token is evidence · every verdict names its proof
Decoded is not verified.
A readable header and payload prove only that two Base64URL segments contain JSON. Trust arrives later—from an expected algorithm, the right key, a valid time window, and your issuer/audience policy.
Header
{ "alg": "HS256", "typ": "JWT" }Payload
{ "sub": "123", "aud": "devsexy-api", "exp": 1766073600 }Signature
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5cTrust ladder
Each rung proves only the next fact.
Compact shape
Exactly three non-empty URL-safe segments
JSON decoded
Header and claims are readable—not trustworthy
Signature verified
Integrity under an expected algorithm and key
Time accepted
exp / nbf with an explicit clock-skew policy
Issuer & audience accepted
Application configuration matches the claims
Domain policy accepted
Roles, tenant, scope, nonce, and revocation rules pass
Algorithm / key contract
The token’s alg field is input, not policy.
HS256 / 384 / 512Shared secretSigner and verifier know the same key
Supported in this workbench
RS256 / PS256RSA public keyPrivate key signs; public key verifies
Use a production JOSE library
ES256 / EdDSAElliptic / EdDSA public keyKey type and curve must match
Use a production JOSE library
noneNo keyNo integrity protection
Reject unless an isolated protocol explicitly allows it
NumericDate clock
JWT time claims are epoch seconds.
NOW · 1,716,073,600
iat1,716,070,000Issued 60 minutes agonbf1,716,072,700Active for 15 minutesexp1,716,075,400Expires in 30 minutesMilliseconds accidentally supplied as seconds land tens of thousands of years away. Clock skew is a deliberate verifier setting, not a reason to ignore expiry.
Issuer & audience checkpoint
A valid signature from the wrong authority is still rejection.
isshttps://id.example.test/Exact trusted issuer match
aud["devsexy-api", "account"]At least the required audience under your policy
tenantproduction-euPrivate claim checked by domain policy
scopetools:readAuthorization still belongs to the resource server
Debugger threat desk
Handle the debugger like a bearer-token workbench.
Bearer exposure
HIGHTokens in URLs, screenshots, logs, clipboard history, and tickets can be replayed.
Weak HMAC secret
HIGHShort or guessable shared secrets can be brute-forced offline.
Algorithm confusion
CRITICALPin an allowlist; never let attacker-controlled alg select policy.
Untrusted kid / JWK URL
HIGHNever turn header key hints into unrestricted file or network lookup.
Signing in a browser
REVIEWUse test keys only; production signing keys belong in controlled infrastructure.