What it does
Splits a JWT into header and payload so you can read the claims. Useful for debugging auth tokens.
How it's safe
Decoding is local — the token never leaves your browser. This tool does not fully validate signatures against a trusted server key.
Watch out
A decoded JWT is still sensitive. Don't paste production tokens into random websites; here at least it stays on your machine.