JWT & OAuth Inspector

Decode JWTs in the popup and run security checks on the claims. Decoding is local — no tokens leave your browser.

Decode A JWT And See Its Security Issues Paste a JWT or an OAuth redirect URL into the popup. The extension decodes header, payload, and signature locally and runs security checks against the claims. WHAT IT DOES - Decodes JWT header, payload, and signature using standard base64url decoding in the popup - Extracts the token from an OAuth redirect URL if you paste one (access_token, id_token, or token in the URL fragment or query) - Runs checks against the claims: alg = none detection, HMAC warning, expiration status, issued-at display, audience presence, issuer presence, subject presence HOW IT WORKS 1. Click the icon 2. Paste a JWT or OAuth redirect URL 3. See the decoded fields and security checks PRIVACY Decoding happens entirely in the popup's JavaScript context. Tokens are never transmitted. No storage, no telemetry. SUPPORT Email: support@cchk.info Privacy policy: https://extensions.cchk.info/jwt-oauth-inspector/privacy Built by Cloud Geeks, a division of Ganda Tech Services.