Token Lens

Decode and explain JWTs, base64, JSON and URLs — and check HS256/384/512 signatures against your secret without it ever leaving the device.

These four formats meet constantly and get confused with each other. Base64 is transport encoding and hides nothing. A JWT is three base64url segments, so its payload is readable by anyone holding it — decoding is not verifying, and that distinction is the most misunderstood thing about the format.

Checking an HS256 signature is the step that closes the gap, because it proves the token was issued by someone holding the secret. Doing it locally is the part that matters: verifying a signature means supplying the secret, and pasting a production signing key into a web service is the sort of mistake that has a long tail.