Why the JWT page does not verify tokens
Decoding a token shows you the header and payload. It does not prove who signed it, and the token stays in the browser.
A JWT is three Base64URL segments. The decoder reads the first two as JSON and shows the third as an opaque signature.
It does not fetch a JWKS document, check exp, or compare a signature. A decoded payload can be forged by anyone who can type JSON. Treat the warning on the page as part of the result, not as a footnote.
The token is not included in the request that loads the page, and it is not written to the application log. If you paste a production access token, clear the field or close the tab when you are done.
Tokens whose header says alg none are called out because verifiers are supposed to reject them.