JWT Decoder & Inspector

A JWT is just three base64url-encoded segments joined by dots — a header, a payload, and a signature — and decoding the first two requires nothing more than reversing that encoding. The genuinely useful part isn't the decode itself, but everything built around it: understanding what the claims actually mean, and knowing what to look for when something's wrong.

This tool draws a clear line between decoding and verifying. Decoding — reading the header and payload — works for any well-formed token, since no cryptographic key is needed to just look inside it. Verifying a signature is different: HS256/384/512 tokens are HMAC-based and can be verified client-side with just the shared secret, which this tool supports directly. RS256, ES256, and other asymmetric algorithms require a public key this tool intentionally doesn't ask for, so it's honest about not being able to verify those.

It also actively looks for known JWT security anti-patterns: an alg of "none" (a critical vulnerability if a server actually accepts it, since it means no signature is required at all), deprecated or weak algorithms, and a missing exp claim (meaning the token never expires). These aren't hypothetical — they've been the root cause of real, documented authentication bypasses in production systems.

Every part of this — decoding, claim interpretation, security analysis, and HMAC verification — runs entirely in your browser. That matters because a JWT often carries live session or authorization data; pasting one into a tool that sends it to a server is a real exposure, even for a token you're just trying to debug.