Skip to main content
D03

JWT inspect

secret · never stored

Decode header and payload, flag expiry, and verify an HMAC signature with your own key, locally.

This tool takes secrets. It writes nothing to storage and clears its fields when you leave the page.