No account
Paste a JWT token (the three parts separated by dots). Everything happens in your browser: nothing is sent to ID-Kit. ?
A JWT (JSON Web Token) is a three-part token: header (algorithm), content (who, until when…) and signature. Decoding does not mean "verifying": only the signature proves the content was not modified.
For HS256 paste the shared secret; for RS256 / ES256 paste the public key (PEM, "BEGIN PUBLIC KEY") or a certificate.?
Without a key, ID-Kit only reads the content. With the right key, it proves the signature is authentic. The key stays in your browser.