JWT inspector

Paste a token to read its header and claims. This never leaves the tab, and no signature is checked — decoding is not verification.

What to check before you trust one

• alg: none accepted anywhere is a full authentication bypass.
• An RS256 token that a server also accepts as HS256 can be forged with the public key as the secret.
• Short exp windows and a kid you control are worth more than a long claim list.
• Claims are not authorization. Check them server-side on every request, not in the client.