Authorized Session Evidence Collector

Capture and classify authentication evidence; unlock advanced JWT inspection and evidence export with Pro.

Capture and classify tokens on an authorized tab. Inspect JWT claims and expiry locally, then export evidence when needed. Collect authentication evidence during an authorized security assessment without manually searching every browser storage location. Start capture on the selected tab, use the application normally, then review token candidates in the extension. Capture and review - Capture authentication and token-like values from request headers, query parameters, and cookies observed in selected-tab network requests. - On request, take a storage snapshot of cookies, localStorage, and sessionStorage for the current page. Chrome host access is requested separately. - Classify candidates such as access tokens, refresh tokens, session identifiers, API keys, CSRF values, JWTs, and opaque tokens. Classifications are heuristic and include a confidence score. - Decode JWT headers and claims locally. Review issuer, audience, subject, issued-at time, expiration, and a live expiry countdown. - Copy an individual value in the free tier. Pro adds full JWT header and claims inspection plus JSON evidence export. Built for deliberate, authorized testing Capture starts only after you select Start capture and applies to the selected tab. Storage snapshots require a separate action and host permission. The extension does not capture request bodies or send captured tokens and storage values to the publisher. Values are sensitive: treat them as credentials, keep them inside the approved evidence process, and revoke test sessions after use. Free and Pro Install and use the free features at no charge. Pro is a one-time purchase through ExtensionPay. The exact amount, currency, and applicable charges are displayed before checkout. There is no recurring subscription for this plan. Payment and license verification depend on ExtensionPay and its payment processor. Important limitations JWT claims are decoded, not signature-validated. The extension does not confirm that a token is valid, authorized, or safe to use. Detection can miss tokens or classify ordinary values as candidates. Browser permissions and application behavior affect what can be observed. This is an assessment aid, not a substitute for an intercepting proxy, application logs, or a complete security review. Sold as is: the extension is provided without a promise that it will detect every token, work with every application, or remain available indefinitely. Mandatory rights under applicable law are not waived.