JWT inspector
Decode-only — we never send the token anywhere. Pure client-side base64 parsing.
Paste a JWT
All decoding happens in your browser. Nothing is sent to the server.
No verification. This tool decodes the JWT for inspection only. It does NOT verify the signature — that requires the issuer's public key (or shared secret) and is the receiver's job, not a debugging tool's.
Keep hardening your site
This is one check of many. Run the rest — every tool is free, no account.
Security headers scan
Grade your live response headers
TLS certificate scan
Grade chain, expiry, and key strength
Security headers builder
Emit a ready-to-paste header block
CSP analyzer
Grade your Content-Security-Policy
Cookie security audit
Check Secure, HttpOnly, SameSite
Mixed-content scanner
Find http:// assets on https pages
Open-redirect detector
Probe redirect params for abuse
HSTS preload checker
Grade against Chrome's preload list