Bulk JWT Inspector
Paste a handful of JWTs — or a log that contains them — and inspect header claims, expiration, and HMAC signature status in one table. Decoding never leaves this tab.
Bulk JWT Inspector
Paste many tokens or a log dump. Decode header/payload locally. Optionally verify HS256 with a shared secret.
Click a row for the full header and payload.
Privacy: decoding runs only in your browser. Close the tab if the paste was a live token.
Why one-at-a-time breaks down
jwt.io is the right shape for a single token you already isolated. Debugging a microservice is the other shape: twenty Authorization lines in a gateway log, a mix of expired user tokens and a service token that is not valid yet, one alg: none leftover from a bad test.
Opening each token in a new tab is how you miss the expired one.
What this tool does
- Pulls JWT-shaped strings out of pasted text (raw tokens,
Bearer …, JSON log lines). - Decodes header and payload locally (Base64URL JSON).
- Shows
alg,kid,sub,iss,aud,exp, andnbfin a table. - Optionally verifies HS256 / HS384 / HS512 when you paste the shared secret. RSA and ECDSA stay “unverified” unless you have the public key on the server — this page does not ask for a private key.
- Flags
alg: noneand missing signatures.
It does not replace backend verification. A green HMAC row means the secret you typed matches the bytes. It does not mean the token is authorized for your API.
Security note
Treat pasted tokens as live credentials. Close the tab when you are done. For a single token, the JWT Decoder is enough. For redacting tokens out of a log before you share it, use the Log Anonymizer.