Inspect a JWT in the browser, not on someone else's server

A JSON Web Token is three Base64URL segments: a header, a payload, and a signature. Anyone who can read the token can read the claims. The signature is the only part that is supposed to be hard to forge, and verifying it needs the matching secret or public key.

Online JWT decoders that upload the token create a second copy of whatever you pasted: session identifiers, internal emails, tenant ids, sometimes the signing secret if it was stuffed into a custom claim. A decoder that runs atob in your tab never receives that copy. SimpleTool's Token Studio is that kind of decoder. It also generates keys and inspects JWKS locally. It does not phone a verification API.

What a local inspector is good for

• Confirming alg, kid, expiry, and audience before you drop a token into a ticket.
• Seeing whether a token is a JWT at all, or just three dotted blobs.
• Building a test token you will sign yourself, still in the browser.

What it cannot do

Without the key, a client-side tool cannot honestly say a production token is valid. Treat an unsigned or unverified payload as untrusted JSON. If you need a server to accept the token, verify it on the server with the real JWKS.

Also remember the rest of the browser: extensions, screenshots, and the clipboard. Local is not the same as air-gapped. It is still the right default over a pastebin with a sequential URL.

Related: the JSON Formatter on this site uses the same rule for API bodies. Format in the tab. Do not send the document to a third-party history page.