Decode header/payload locally. Optional shared-secret field verifies HS256/HS512 only in this browser (Web Crypto). Other algs stay inspect-only — no remote JWKS fetch.
Paste JSON only — this desk does not fetch JWKS URLs. Matching is string kid equality against keys[], not signature verification.
Need to send the token? Try API Tester with an Authorization: Bearer … header (local fetch only).
Paste a JWT to decode