Jotscope - JWT Inspector

A JWT decoder that's actually readable - and catches the dangerous tokens other tools quietly wave through. Paste a token and Jotscope breaks it down instantly, entirely in your browser. Decoding never touches the network! 🔍 See through any token • Auto-decodes the moment you paste - no clicks needed • Pulls tokens straight out of URLs and OAuth-callback text • Load a sample token to explore the interface 📖 A claim view you can actually read • Every claim colour-coded, with plain-English tooltips for standard and vendor claims • Scopes, groups and roles shown as chips, not raw strings • Nested claims rendered as a collapsible tree • Timestamps as exact date plus relative time • Privileged roles highlighted so they don't hide in the noise ⏱️ Watch the clock • Live countdown and an expiry progress bar • Distinct states: valid, expiring soon, expired, not yet active 🔐 Honest signature verification • A prominent warning for unsigned tokens and unrecognized algorithms • A real distinction between "couldn't verify" and "signature is invalid" • Optional JWKS verification, off by default ⚙️ Built for the way you work • Flip any panel between Visual and JSON • Copy the JSON, a Bearer value, or a ready-to-paste cURL header • Searchable, filterable history, kept only in your browser - clear it, sweep expired entries, or turn it off entirely • Dark mode that follows your system 🔒 Private by design, and provably so Decoding is 100% local. No analytics, no tracking, no third-party code. The only network request Jotscope can make is the optional JWKS fetch, which sends no token data. It's open source with no build step, so the code you can read is the code that runs. Requires Chrome 116+. Source: https://github.com/hradecek/jotscope