JWT inspector

Decode a JSON Web Token, review its header and claims, and audit it for insecure configuration (alg none, missing expiry, sensitive data in the payload). Tokens are decoded in your browser only.

Token

Paste a JWT — never paste production tokens you don't own