JWT Inspector Chrome

The tool decodes a JWT into its header, payload, and signature, highlighting issuer, audience, subject, and standard time-based claims. It presents claims in a structured view and flags expired or not-yet-valid tokens. When enabled, it verifies the signature using a provided secret, public key, or JWKS endpoint. It supports common algorithms such as HS256, RS256, and ES256 and offers a token fingerprint for quick tamper checks. The system runs entirely in the browser, avoiding server calls to protect token confidentiality. This makes it suitable for development, security reviews, and API integration testing. By exposing both the raw components and the parsed claims, it helps engineers validate authentication flows and identify misconfigurations or token leakage early. The tool also exposes edge cases like missing keys for verification or unsupported algorithms, guiding users toward correct setup. Outputs include the decoded header and payload, signature viability, and normalized time formats for easy comparison across tools. Overall, it provides a focused, domain-specific workflow for JWT analysis without introducing UI-centric concerns.