A common signed compact JWT has header.payload.signature. Each segment uses the URL-safe Base64 alphabet without ordinary equals padding. Decoded header and payload bytes must be valid UTF-8 JSON objects; the signature stays binary material.
Canonical Base64URL matters
Strict decoding rejects ordinary plus, slash and equals characters, impossible one-character remainders and non-zero unused tail bits. Accepting multiple textual encodings for the same bytes makes logs, comparisons and security review harder.
JSON ambiguity is avoidable
Duplicate member names can produce different meanings in different parsers. JWTLens rejects duplicates at every nesting depth and retains number lexemes so a large integer is displayed exactly instead of being rounded through a binary floating-point value.
Verification checklist
After inspecting structure, verify the compact token with a maintained JOSE library in the service that receives it. Pin the allowed algorithm; select the trusted key by reviewed policy; validate the signature before trusting claims; then enforce issuer, audience, subject, expiry, not-before, clock tolerance and application-specific requirements. Reject unexpected critical headers and duplicate data before authorization. JWTLens deliberately performs none of these trust decisions.