JWT decoder
Bearer, quotes and line breaks are ignored. The token is never put in the address bar.
Header
Payload
Claims
Signature
Checks HS256, HS384 and HS512 (HMAC) signatures. The secret stays in this page and is never stored or sent anywhere.
Decoding happens in your browser; nothing you paste is sent to the server. Decoding does not prove a token is genuine: only a valid signature does.