Base64 guides

How to Read a Base64 JWT Safely

A JSON Web Token has header, payload, and signature parts. The first two are JSON encoded with Base64URL. They are readable by design; decoding is not trusting.

Inspect without trusting

const [header,payload]=token.split('.'); const json=part=>JSON.parse(atob(part.replace(/-/g,'+').replace(/_/g,'/')));

Validate on the server

Check the signature with the expected algorithm and key, then validate issuer, audience, expiration, nonce, and required claims. Never choose an algorithm from an untrusted header.

Debugging workflow

Use the decoder only for diagnostics. Remove tokens from logs, screenshots, and public issue reports.