Universal JWT Inspector
Safely inspect and decode JWT headers, claims, and expiry without leaking tokens
Request a feature or report a bug: locache.download@gmail.com
About Universal JWT Inspector
Inspect JWT tokens locally. Decodes header and payload, validates standard claims (exp, nbf, iat), flags weak algorithms and alg:none without transmitting tokens.
How to use
- 1Paste Token: Paste your JWT string directly or via Ctrl/Cmd+K Smart Paste.
- 2Review Claims: Inspect formatted Header and Payload JSON alongside human-readable expiry timestamps.
- 3Security Audit: Review automated security checks flagging algorithm issues or missing expiry.
FAQ
Why should I avoid using public online JWT decoders?
Many online decoders send your tokens to backend servers or log them in server access logs. If a token contains sensitive claims or production credentials, your system could be compromised. Locache runs completely client-side.
Does this tool support nested JWTs or expired timestamps?
Yes, it highlights expired tokens, validates timestamp precision, and warns about insecure configurations like alg:none.