Protect data and access
JWT and Session Inspector
This browser-local JWT inspector decodes a token header and claims, highlights basic time and algorithm signals and reviews pasted session-cookie attributes.
Local analyzer: Runs entirely in this browser. Tokens are decoded locally and are never verified or sent.
Synthetic token with a placeholder signature. This tool does not verify signatures.
Sample result
An example of the output shape, not a result from your input:
Token has no expiry claim and is not marked HttpOnly at the cookie layer
Run this on your whole app
This check covered only what you pasted or selected here. A free trial lets you authorize a repository, live URL or API, run the checks available for your authorized target and plan and keep one launch report you can share.
Start free trialRelated tools
Most reviewers run two or three of these together. Each runs in your browser and states what it cannot prove.
See all free toolsWhat this checks
- JWT algorithm, issuer, audience, expiration and not-before claims
- Expired, not-yet-valid, missing-expiry and alg=none signals
- Secure, HttpOnly and SameSite attributes in pasted Set-Cookie values
What this cannot prove
- It decodes JWT data but does not verify the signature, issuer, audience, key or revocation state
- Decoded claims are untrusted input and do not prove a session is valid
- Use only non-production tokens; this page does not inspect server-side session behavior
Primary references
Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.
Frequently asked questions
Does this upload my input?
Tokens are decoded locally and are never verified or sent.
Does a clear result mean my app is secure?
No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.