The token
A JWT is a credential: whoever holds it can act as that user until it expires. It is read here in your own browser and never sent anywhere, which is the reason this tool exists rather than a link to the popular one.
Header
Payload
what the token claims — not verifiedCheck the signature
The shared secret is the thing that mints tokens. Pasting it anywhere is a bigger act than pasting the token it signed — it stays in this browser, but think before you fetch it from production.
The algorithm is taken from the box above, never from the token's own header — a verifier that lets the thing it is checking choose the method can be told what to do by whoever wrote it.
The claims
Read in this browser — nothing is uploaded, nothing is stored, and no request leaves the page. Decoding is not verifying. Both readable parts of a JWT are base64url, which is an encoding and not a protection: anyone can write a token that says whatever they like and it will decode perfectly. Until the signature has been checked against a key, everything shown is what the token claims, not what is true.
The JWT Decoder needs JavaScript: the token is decoded and its signature checked in this browser, which is why a live credential never has to be sent anywhere. With JavaScript switched off there is nothing to do the work.