Your JWT is a Postcard, Not an Envelope (opens in new tab)

Do this before you read anything else. Grab any JWT your app hands out and paste it into jwt.io. Look at what shows up. The middle section…