Tools that hand back text

A JWT is not a piece of data about a credential. It IS the credential: anyone holding it can act as whoever it was issued to, until it expires. The same is true of the signing key you would need in order to verify one. Every online JWT decoder asks you to paste both into a text box on somebody else's website, and the good ones promise in prose that nothing is transmitted. This one is a static file with no endpoint to transmit to, which is a different kind of claim — you can check it by opening your browser's network panel, or by disconnecting from the internet after the page loads and watching the tools keep working.

Decoding a JWT is unpacking base64url; anybody can do it to any token, and it proves nothing at all about whether the token is genuine. Verifying it is arithmetic against a key, and it is the only step that answers the question people actually have. A tool that shows a neatly formatted payload and calls it done invites you to trust a token you have not checked — so this one keeps the two apart on screen and never styles an unverified token as though it had passed.

The UUIDs come from your browser's cryptographic random source, the same one that seeds TLS, rather than from Math.random — which is fast, predictable, and completely unsuitable for anything that has to be unguessable. Which version to use is a real decision with a real answer, so the generator explains it rather than presenting five options and leaving you to guess: v4 when you just need an identifier, v7 when the identifiers become database keys and you want them to sort by time, v5 when the same input must always produce the same identifier.