Your JWT Decoder Should Never Ask for Your Signing Secret

A JWT looks like gibberish until you decode it — three Base64URL segments separated by dots: header, payload, signature. The header and payload aren't encrypted, just encoded, so anyone can read them. The signature is what proves the token wasn't tampered with, and verifying it requires the signing secret or public key. I built ForgePlug's JWT Decoder to make that distinction explicit: it decodes, it does not verify, and it never asks for your secret key. It shows standard and custom claims, a live expiration countdown, supports HS256/RS256/ES256, and runs 100% client-side — your token never leaves the browser. Try it: https://www.forgeplug.com/tools/jwt-decoder — free, no sign-up, part of ForgePlug's 60+ tools.