JWT header and payload segments use Base64URL. The tool converts each segment to bytes, requires valid UTF-8, and parses each as a JSON object. The signature segment is described but never verified.
Limits and assumptions
A token must contain exactly three nonempty segments and stay within 2 MB. Decoding shows what a token contains. It does not verify that the token is valid, trusted, or untampered. Avoid pasting production secrets into any tool you do not trust.
