Skip to main content
Application security tools

Application security / FREE TOOL

JWT inspector

Decode token headers and claims. Inspect expiry, declared algorithms, and key references without sending the token anywhere.

Local review / optional AI

01 Your input

Local processing only. Maximum file size: 2 MB.

02 Your results

A closer look starts here.

Add your input and run the check. We will show the observations and explain what needs review.

 

A QUICK WALKTHROUGH

How to use it

  1. 01Paste a token or use the synthetic example.
  2. 02Inspect decoded claims and time-related signals.
  3. 03Verify signatures and policy in your trusted application.

What this check can tell you

Decoding does not verify the signature, issuer, audience, or acceptance by a server. All decoded values are untrusted. This tool accepts three-part JWTs, not encrypted JWEs.

The initial review processes files in this tab. If you choose the optional AI summary, the displayed findings are sent to Cloudflare AI; your raw file, result tables and decoded token claims are excluded.

RFC 7519: JSON Web Token
All tools