About JWTs
A JWT has three Base64URL parts — header, payload and signature — separated by dots. The header and payload are just encoded (not encrypted), so anyone can read them; the signature proves they weren’t tampered with.
FAQ
Does this verify the token? No — it only decodes. Verifying the signature needs the secret (HMAC) or public key (RSA/EC), which you should never paste into a website.
Is it private? Yes — the token is decoded entirely in your browser and never uploaded.