Header, payload, expiry and claims — decoded offline. The token is never sent anywhere, which is the whole point.
Why this page has no server. A JWT is a credential. Pasting a live one
into a site that posts it somewhere hands over whatever it authorises — which is why this
tool is a single static file that decodes in the page and has nowhere to send anything.
You can save it and use it with the network off.
Decoding is not verifying. The header and payload are only base64url —
anyone can read them, and anyone can forge them. A token is only trustworthy once its
signature has been checked against the issuer's key, and that has to happen on your server
with the secret. A decoder that claimed to "validate" your token without the key would be
lying to you.