← Web security

JWT inspector

Decode-only — we never send the token anywhere. Pure client-side base64 parsing.

Paste a JWT

All decoding happens in your browser. Nothing is sent to the server.

No verification. This tool decodes the JWT for inspection only. It does NOT verify the signature — that requires the issuer's public key (or shared secret) and is the receiver's job, not a debugging tool's.