Question 1

Is it safe to paste a JWT here?

Accepted Answer

JWT parsing, verification, and signing run locally in the browser. Use sanitized lab tokens whenever possible because browser extensions, clipboard history, screen capture, and analytics are separate trust considerations.

Question 2

Can a JWT be decoded without its secret?

Accepted Answer

Yes. JWT headers and payloads are encoded, not encrypted. A secret or public key is needed to verify the signature, not to read the claims.

Question 3

Why can an expired token have a valid signature?

Accepted Answer

Signature validity and claim validity are separate checks. An expired token can still have an authentic signature while being unacceptable under the verifier's time policy.

Question 4

Which JWT algorithms are supported?

Accepted Answer

The workbench supports HMAC SHA-2, RSA PKCS#1 v1.5, RSA-PSS, and ECDSA variants, plus intentionally unsigned alg none tokens for authorized security testing.

Question 5

Does the JWKS URL receive my JWT?

Accepted Answer

No. An explicit verification requests only the JWKS document. The endpoint still receives ordinary request metadata such as the visitor's IP address and Origin and must permit CORS access.