Security
JWT Inspector
Decode a JWT's header and payload and check expiry - decode-only, entirely in your browser, no signature verification claimed.
Paste a JWT
Decodes only - this never sees your signing key, so it can show what a token contains, not whether it's authentic.
Expired - expires 5/20/2025, 9:03:42 PM
Header
{
"alg": "HS256",
"typ": "JWT"
}Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1716239022,
"exp": 1747775022
}iat: 5/20/2024, 9:03:42 PMexp: 5/20/2025, 9:03:42 PM
This is one question. ArchSetu answers it for a whole repository.
Call graph, dead code, blast radius and a health score, in about a minute.
Related tools
All Security tools →CORS Config Generator/ExplainerOrigins, methods, headers to generated CORS headers.Security Risk ScannerPaste a real GitHub repo - hardcoded secrets, unsafe dynamic execution, string-built SQL, insecure transport, and weak cryptography. Sign in required.Bcrypt Cost Factor CalculatorA measured benchmark on your hardware plus a target hash time to the right bcrypt cost factor.AWS IAM Policy GeneratorService, access level, and a resource ARN to a valid, scoped IAM policy JSON.API Key Format IdentifierPaste a key prefix - which service it belongs to, based on documented prefix conventions.OAuth Redirect URI ValidatorCheck a redirect URI against the OAuth 2.0 Security BCP - HTTPS, exact-match, no wildcards.
Was this tool helpful?