Decodes a JSON Web Token's header and payload, flags its expiry, and can verify an HMAC signature if you provide the secret.
JWTs are everywhere in modern web auth, and being able to see exactly what's inside one — and whether it's actually valid — is a genuinely common developer need.
Paste a token. The header and payload are decoded immediately; paste a secret to check an HMAC signature.
Only HMAC algorithms (HS256/HS384/HS512) can be verified. RSA/EC-signed tokens (RS256, ES256, etc.) are decoded but not verified — that's stated plainly rather than silently skipped.