JWT Inspector

100% in your browser · data never leaves your device

Decode, audit, verify and diff JSON Web Tokens — entirely in your browser. Your token never leaves this page. The paid API endpoint for agents is at POST /api/jwt-inspector.

Header 

    

    

      Payload
      

    

    

      Signature
      

    

  


  

    Security audit
    

  


  

    Explain claims
    

  


  

    Verify signature (WebCrypto, local)
    

      
      
      

        
        
      

      
      

    

  


  

    Diff vs. second token
    
    
    

  



    
How to use
  1. Paste a JWT into the field — header, payload and signature are decoded instantly.
  2. Inspect claims, expiry and algorithm.
  3. Optionally paste a secret or public key to verify the signature.
  4. Diff two tokens to see what changed between issuances.
Where it applies
  • Debugging an authentication failure without leaving the browser.
  • Checking token expiry and scopes during incident response.
  • Verifying that a token was signed with the expected key.
  • Agents decoding tokens via the paid <code>POST /api/jwt-inspector</code> endpoint.