Decode a JWT without sending it to a website

State the credential point plainly, because people paste tokens into websites every day without thinking about it. A bearer token is exactly what the name says: whoever holds it is treated as you, by every system that accepts it, until it expires. Handing one to a hosted decoder gives that service a working session. Whether anyone looks is beside the point; the exposure has already happened, and the only real remedy is revocation, which most people cannot do quickly.

The parts are not equally interesting. The payload is an encoding rather than a cipher, so anybody holding the token can already read every claim in it; that is by design and it is why nothing confidential belongs in a claim. The signature is the only part that carries weight, and checking it needs the corresponding key, which is the step that separates reading a token from trusting one.

Read the standard claims when you are debugging. An expired token, a token that is not yet valid, a token issued by the wrong issuer and a token meant for a different audience all fail, and they fail for completely different reasons that a single rejection message rarely distinguishes. The claim set tells you which of those you are looking at in about ten seconds.

Verify the locality with the network off, and treat that as the normal way to work with tokens rather than a demonstration. A token you decoded offline was never anywhere except your own machine, which is the only state in which a live credential is not a disclosure waiting to be discovered.