JWT Inspector
Decode a JWT and audit its claims for common issues.
JWT
Decoded locally — this does not verify the signature, only inspects the claims.
Decoded & audit
Paste a JWT to decode its header and payload.
About the JWT Inspector
Decode a JSON Web Token's header and payload locally, and flag common risks like alg:none, a missing signature, missing or long-lived exp, and missing aud/iss claims. This does not verify cryptographic signatures.
Examples
Decode a token
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjMifQ.abcOutput
{"sub":"123"}Related tools
JWT Decoder
Encoders & Crypto
Decode a JWT's header and payload, and check expiry.
CORS Config Generator
Security
Generate CORS headers/config for Nginx, Apache, Express, or Workers.
CSP Builder
Security
Build a Content-Security-Policy header from per-directive sources.
Htpasswd Generator
Security
Generate .htpasswd lines using SHA-1 or plain text.
Password Strength Checker
Security
Estimate password entropy, crack time, and get actionable advice.
Robots.txt Security Checker
Security
Scan robots.txt for accidental disclosure of sensitive paths.
Frequently asked questions
Read more
- Understanding JWT: structure, claims and safe verification
What is actually inside a JSON Web Token, which claims matter, and why decoding a JWT is not the same as verifying it.
Version 1.0.0 · Updated 2026-08-06 · Runs entirely in your browser