How do I inspect a JWT without sending it to any server?

The only safe way to decode a real token is locally. Options:

Browser (DevTools / Node):

Code:

atob(token.split('.')[1])

(handle base64url padding if needed)

Python:

Code:

import base64, json
payload = token.split('.')[1] + '=='
json.loads(base64.urlsafe_b64decode(payload))

Zero-trust tool: the JWT Inspector on tools.php – WebCrypto + atob running entirely in your browser tab. Nothing is transmitted, which is the whole point.

Rule of thumb: if a tool needs your token "sent to a server for decoding", don't use it.

How do you debug JWTs day to day?