JWT Inspector — A Privacy-First Alternative to jwt.io

The Problem with jwt.io

If you're a backend developer working with JWTs (JSON Web Tokens), you've probably used jwt.io — the go-to tool for decoding and debugging tokens.

It's convenient. But there's a catch: when you paste a JWT into jwt.io, it gets sent to their server.

This might not matter for test tokens, but what about:

Production tokens from your company's API
Tokens containing sensitive user data
Tokens from client systems where you can't expose the data

You can't paste those into an external service. Period.

Building a Privacy-First Alternative

I built JWT Inspector as a client-side-only tool. Your token never leaves your browser.

How It Works

The entire tool is a single HTML file with zero dependencies. It uses the browser's built-in atob() function to decode Base64URL-encoded JSON — no server calls, no tracking, no data leaves your machine.

function base64urlDecode(str) {
  // Add padding if needed
  str = str.replace(/-/g, '+').replace(/_/g, '/');
  while (str.length % 4) str += '=';
  try {
    return decodeURIComponent(atob(str).split('').map(function(c) {
      return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2);
    }).join(''));
  } catch (e) {
    return null;
  }
}

That's it. No frameworks. No build step. No API keys.

Features

Instant decode: Paste a JWT and see header, payload, and signature decoded in real-time
JSON pretty-printing: All claims are formatted for easy reading
Error highlighting: Invalid tokens are clearly marked
One-click copy: Copy any section to your clipboard
Dark mode: Automatically adapts to your system preference
Works offline: No internet connection needed after loading

Why This Matters

JWTs are everywhere in modern APIs. They contain claims about users, roles, permissions, and more. When you're debugging a token issue in production, you don't want to risk exposing that data.

With JWT Inspector:

Your tokens stay on your machine
No account required
No analytics or tracking
Completely free and open source

Try It

Check out JWT Inspector — it's free, private, and works right in your browser.

No signup. No data collection. Just decode your tokens safely.

DEV Community