Paste a JSON Web Token to decode its header and payload. This only decodes — it does not and cannot verify the signature (that needs the signing secret/key, which never leaves your server). Nothing here is sent anywhere; decoding happens entirely in your browser.