Safer than on most sites, because decoding happens entirely in your browser — no request is made and nothing is logged. That said, a JWT is a live credential: the safest habit is to only paste tokens from a development environment, or to revoke a production token after inspecting it. You can verify the no-network claim in your devtools Network tab.
Why is the signature not verified?
Verification requires the signing key, and a tool that asks you to paste your HMAC secret or private key is a tool you should not use. Decoding tells you what a token claims; only your server, holding the key, can tell you whether those claims are authentic.
Is a JWT encrypted?
No — a standard JWS token is signed, not encrypted. The header and payload are plain Base64url, readable by anyone who has the token. Never put a password, API key or unnecessary personal data in a JWT payload. (JWE is a separate, genuinely encrypted format that is rarely used in practice.)
What does the "alg: none" algorithm mean?
It means the token is unsigned, and it is a historically serious vulnerability: several libraries once accepted alg:none tokens as valid, letting an attacker forge any claims. Any token you see with alg:none should be treated as untrusted, and your verifier should reject it explicitly rather than relying on defaults.