DEVELOPER GUIDE
What is inside a JWT?
A JSON Web Token packages claims into a compact string. Decoding is useful for inspection, but it is not proof that a token is trustworthy.
Header, payload and signature
A typical JWT has three Base64URL-encoded sections separated by full stops. The header names the token type and algorithm, the payload contains claims, and the signature can detect tampering when verified correctly.
Common claims
The iss claim identifies the issuer, sub identifies the subject, aud names the intended audience, exp sets an expiry time and iat records when the token was issued. Applications may also define their own claims.
Decoding is not verification
Anyone can create a JWT-looking string. Reading its payload only reveals what it claims. Verification must check the signature, allowed algorithm, issuer, audience, expiry and application-specific rules on a trusted server.
Treat tokens as credentials
JWT payloads are encoded, not encrypted. Avoid live authentication tokens in remote services and prefer expired or redacted samples. Kanfire decodes locally, but normal browser and device security still applies.