Decoding a JWT is only half the job — the question that matters is whether the token you pasted ever left your machine.
| Capability | jsonversal | jwt.io |
|---|---|---|
| Runs in browser (no upload) | Yes, always | Verify current policy |
| Account required | No | No |
| Cost | Free | Free |
| Decode header & payload | Yes | Yes |
| Signature verification (HS256/384/512) | Yes, local Web Crypto | Yes |
| Sign / generate tokens | Yes | Limited |
| Expiry & not-before checks | Yes | Yes |
| Safe for live tokens & secrets | Yes — nothing leaves the tab | Verify current policy |
Both tools decode a token and verify an HMAC signature correctly. The difference shows up in two workflows. First, debugging a live session token: a real access token is a live credential, and pasting it into a tool that processes input on a server means it transits someone else's infrastructure. jsonversal decodes with the browser's own Web Crypto API, so the token is inspected in the tab and never sent. Second, testing your own auth flow: jsonversal can both decode and sign (HS256/384/512), so you can mint a token, mutate a claim, and re-verify the signature in one place without leaving the page.
For quick inspection of a non-sensitive sample token, jwt.io is perfectly serviceable — just be mindful of what you paste into it.