JWT inspect

secret · never stored

Decode header and payload, flag expiry, and verify an HMAC signature with your own key, locally.

This tool takes secrets. It writes nothing to storage and clears its fields when you leave the page.

WHAT IT WILL NOT DO

Only the signature is checked — never audience, issuer, scope, jti replay or revocation.
No network, no JWKS fetch: paste an SPKI key for asymmetric algorithms. A JWE is identified, not decrypted.
It does not mint or rewrite tokens. Use E05 for a bare HMAC, E10 for an X.509 certificate.