What is Jwt Local Inspector
The JWT Local Inspector is a client-side tool that scans the browser's localStorage for JSON Web Tokens (JWTs) and displays their decoded payloads. It iterates over every key in localStorage, checks if the value contains at least two dots (the minimum structure of a JWT: header.payload.signature), and for matching entries, Base64Url-decodes the payload segment to reveal the token's claims. The decoded payload is displayed as formatted JSON inside an expandable details element, making it easy to read claims like sub (subject), iss (issuer), exp (expiration), iat (issued at), and any custom claims. The tool does not verify signatures — it only decodes the payload for inspection. This is essential for debugging authentication flows: you can instantly see what claims your application is storing, verify that tokens contain the expected data, and check expiration timestamps without copying tokens to a separate decoder.
How to Use Jwt Local Inspector
- Step 1: Open the JWT Local Inspector. The tool immediately scans localStorage on load and displays any JWT-like values it finds.
- Step 2: Review the results: each JWT is shown under its localStorage key name. Click the key name to expand and see the decoded payload as formatted JSON.
- Step 3: The decoded payload shows all JWT claims including subject, issuer, expiration, and any custom claims your application stores in the token.
- Step 4: If no JWTs are found, the tool displays a message indicating that localStorage does not contain any token-like values for this origin.
Why Use Jwt Local Inspector
During authentication debugging, developers frequently need to inspect the JWT stored in localStorage to verify claims, check expiration, or confirm the token was issued correctly. Without this tool, the process involves opening DevTools, finding the token key, copying the value, pasting it into a JWT decoder (like jwt.io), and then reading the decoded output. The JWT Local Inspector eliminates those steps — it automatically finds and decodes all tokens, presenting the claims in a readable format immediately. This is especially valuable when debugging multi-token flows (access token + refresh token), verifying that claims are correctly populated after login, and checking that token expiration aligns with your session management policy.
Privacy & Security
This tool runs entirely in your browser — no data ever leaves your device. There is no server round-trip, no upload, no logging, and no account required. Your input is processed locally using client-side JavaScript and is never stored, transmitted, or accessible to anyone else. When you close the tab, everything disappears.
Frequently Asked Questions
Does this verify JWT signatures?
<p>No. The tool only decodes the payload for inspection. Signature verification requires the signing key and is not performed. For verification, use the HS256 or RS256 JWT Verifier tools.</p>
What if the token is not a valid JWT?
<p>The tool checks for the dot-separated structure (at least 2 dots). If a value passes this check but the payload is not valid Base64Url or JSON, a parse error is displayed instead of the claims.</p>
Can it find tokens stored under non-obvious keys?
<p>The tool scans all localStorage keys and checks each value for the JWT structure. It does not assume a specific key name like 'token' or 'access_token' — any value matching the three-part structure is detected.</p>
Can it find tokens stored in sessionStorage?
<p>No. The tool only scans localStorage. For sessionStorage tokens, you would need to check the sessionStorage API separately.</p>
What if the token is expired?
<p>The tool displays the decoded payload including the exp (expiration) claim as a Unix timestamp. It does not check expiration — you can see the timestamp and compare it to the current time.</p>