Local JWT inspector / privacy-first
Inspect a JWT locally.
Decode only the header, payload, and expiry. The signature is not verified, and input is not uploaded or saved.
Enter a JWT
Do not assume a token is safe to share. The signature is always unverified.
What is covered
- Display header and payload JSON, exp/iat, and expiry locally.
- The signature is checked only for structure; no verification, JWKS lookup, or revocation check.
- 5 MiB input limit; no external request or input storage. Invalid tokens fail closed.