Decode JWT Payloads Locally: What the Claims Tell You (and Don't)

JWTs are designed to be readable by the client. That is useful for debugging, but it also means a real token can contain user IDs, email addresses, roles, scopes and expiry data that should not be pas...