JWT & tokens tools

A JWT you are debugging is, by definition, a working credential — and its signing secret is the key to minting more. Where you paste those is a security decision, not a convenience one, which is why all three tools here run as pure functions in your tab on a page the browser forbids from opening a network connection.

Inspect

JWT decoder

Decode a token, read its claims, and see exactly when it expires.

JWT security check

Check a token for alg:none, missing expiry, unbounded audience and leaked claims.

JWT signature verifier

Check an HS256 signature against your secret, without the secret leaving the tab.