JWT Decode Decode a JWT by base64url-decoding its header and payload. Does NOT verify signatures — use for that. Steps 1. Split the token on into three parts (header, payload, signature). 2. Base64url-decode and parse parts 1 and 2 as JSON. 3. Display header, payload (with all claims), and the raw signature string. 4. For , , — show both the Unix timestamp and human-readable UTC. If is past, note expired and by how long. 5. Run security checks (see below). Output Format Security Checks Flag these prominently when found: - — Token is unsigned. Warn: "This token has no signature and cannot be t…