JWT Decoder
Built first-party — no third-party code vendored. Decoding works for any token; secret verification only covers HMAC algorithms (HS256/HS384/HS512) via the browser's native Web Crypto API, since RS/ES/PS algorithms need the server's public key, not a guessable secret. Signing math verified against the canonical jwt.io example token before shipping this. The token and any candidate secrets you enter never leave your browser — there's no server for them to go to.
Decode
Header
Payload
Verify against a candidate secret
One secret per line — every candidate is tried.