把 JWT 粘贴进来即可读出 header 和 payload，签发/生效/过期时间一目了然，还会标出是否已过期、还剩多久。HS256 令牌可以输入密钥在本地验签，令牌不经过任何服务器。Paste a JWT to read its header and payload, with issued-at, not-before and expiry times spelled out and a live expired/valid status. HS256 tokens can be signature-checked locally with your secret — the token never touches a server.
仅支持 HS256。验证在本地用 Web Crypto 完成，令牌和密钥都不会离开浏览器。RS256/ES256 的令牌请用签发方的公钥在服务端验证。HS256 only. Verification runs locally with Web Crypto — neither the token nor the secret leaves your browser. For RS256/ES256 tokens, verify with the issuer's public key on your server.
安全提醒：JWT 的 payload 只是 Base64 编码、不是加密，任何人拿到令牌都能读出内容，所以不要往 payload 里放密码等敏感信息。另外「解码成功」不等于「可信」：只有验签通过，才能确认令牌没被篡改。Security notes: a JWT payload is only Base64-encoded, not encrypted — anyone holding the token can read it, so never put secrets like passwords in it. And a successful decode does not mean trustworthy: only a verified signature proves the token was not tampered with.