JWT decoding is not verification
JWT header and payload segments are Base64URL encoded, not encrypted. Anyone holding a token can usually read those claims. Decoding tells you what the token says; only cryptographic signature verification tells you whether a trusted issuer actually signed it.
Security tip
Avoid pasting production bearer tokens into third-party tools. CyberKit decodes the submitted value for the current request and does not intentionally persist it, but sensitive authentication material is best inspected in a controlled local environment.