What is a JWT? Understand tokens in three steps (without the signature rabbit hole)
When debugging a login session, look at the header and payload first — signature verification comes later.
The scenario
You want to confirm whether a token carries sub or exp, without pulling in a full authentication library.
Open the JWT decoder and paste it to see the contents. Important: an online tool does not verify the signature — production verification has to happen on the server.