JWT decoder

Decoding is base64, not trust: this shows what the token CLAIMS, and verifies nothing — the signature is checked by whoever holds the secret, not by reading it. Everything stays in your browser, which matters, because a pasted JWT is usually a live credential.