Content overview: “JWT Inspector X”. Paste any JWT and it instantly splits the three segments (header / payload / signature) with colour-coded rendering, base64url-decodes the header and payload to indented JSON, and pretty-prints every claim. A live claim auditor turns raw JSON into a security readout: exp / iat / nbf are converted to ISO timestamps with age and expiry deltas, iss / aud / sub / jti / scope / role / roles are surfaced as first-class chips, and each finding is colour-coded ok / warn / bad.
A dedicated risk panel flags the classic pitfalls that break real APIs — alg:none (algorithm confusion), missing exp, suspicious kid values that look like path traversal, RSA→HS key-confusion patterns and clock-skew issues. For HS256, HS384 and HS512 tokens the built-in verifier uses the browser's WebCrypto API to recompute the HMAC from a secret you supply and does a constant-time comparison against the signature so you know instantly whether a token was tampered with or the secret is wrong. The full version stays on the original page, which this listing opens directly.