Tools that work on a string, not a file

A JWT is not a piece of data about a credential. It IS the credential: anyone holding it can act as whoever it was issued to, until it expires. The same is true of the signing key you would need in order to verify one — and of a Wi-Fi password typed into a QR generator, or a product number that has not been announced yet. Every online tool of this kind asks you to paste those into a text box on somebody else's website, and the good ones promise in prose that nothing is transmitted. This one is a static file with no endpoint to transmit to, which is a different kind of claim — you can check it by opening your browser's network panel, or by disconnecting from the internet after the page loads and watching the tools keep working.

Decoding a JWT is unpacking base64url; anybody can do it to any token, and it proves nothing at all about whether the token is genuine. Verifying it is arithmetic against a key, and it is the only step that answers the question people actually have. A tool that shows a neatly formatted payload and calls it done invites you to trust a token you have not checked — so this one keeps the two apart on screen and never styles an unverified token as though it had passed.

The UUIDs come from your browser's cryptographic random source, the same one that seeds TLS, rather than from Math.random — which is fast, predictable and completely unsuitable for anything that must be unguessable; the generator explains which version to use rather than listing five and leaving you to guess. The two code makers are the same idea with a drawing on the end: what you type is the product, and the square or the bars are only how a machine reads it back. A QR code is bytes, and whether a phone offers to join your network or shows a line of punctuation depends entirely on how those bytes were written, so that tool shows you the exact string it encoded beside the picture. A barcode's last digit is arithmetic over the others — which is how a scanner survives a scratch — so that one either calculates it or checks the one you brought.