Paste a JSON Web Token (JWT) to decode its header and payload, read the claims in plain English, and flag insecure signing — like the “none” algorithm or an already-expired token. Runs entirely in your browser: the token is never sent anywhere. Decoding is not verifying — this does not check the signature against a secret.