English
Deutsch
PolskiSave tool
A JSON Web Token is signed, not encrypted: anyone holding it can read the payload. This tool decodes header and payload, does the arithmetic on the lifetime, and can recompute an HS256 signature without the secret ever leaving the browser.
JWT & OAuth Token Inspector
Articles that explain this
- JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying Web Development
- Secure WordPress REST API: OAuth 2.0 and Custom Authorized Endpoints Web Development
- Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations Digital Marketing
- When Amazon Ads Access Expires: Monitoring the 365-Day Refresh Token Limit Digital Marketing
Other tools
- WordPress REST Route & Permission Callback Generator
- GA4 Advisor & runReport Verifier
- Web Bot Auth Signature Inspector and Crawler Range Checker
- GA4 API Response Inspector
- CSP Header Generator & Tracking-Linter
- Set-Cookie Analyzer & ITP Lifetime Simulator
- Well-known & Policy Files Inspector: security.txt, ads.txt, gpc.json, llms.txt
- Crawler IP Verifier: Googlebot, Bingbot, GPTBot and Others
- Canonical, hreflang and Indexing Signal Inspector
- WordPress REST Route Inventory: what a site hands out without a login
Related articles
- Secure WordPress REST API: OAuth 2.0 and Custom Authorized Endpoints
- JSON Web Tokens: Structure, What Belongs in the Payload and the Difference Between Decoding and Verifying
- Google Ads API Passkey Requirement: What It Applies To and How to Find Forgotten Authorizations
- When Amazon Ads Access Expires: Monitoring the 365-Day Refresh Token Limit
- Identifying Bots with Digital Signatures: How Web Bot Auth Works
- Building Custom Data APIs in WordPress: Validating Requests and Limiting Responses
- HTTP Security Headers Explained: Which Ones Protect and Which Are Merely Present
- Detecting Forged Email Senders: What SPF, DKIM and DMARC Check
- Running a Local AI Language Model with Ollama and Securing Access
- Identifying Real Search Engine Bots: Checking IP Addresses and DNS Names