Protect data and access
JWT and Session Inspector
This browser-local JWT inspector decodes a token header and claims, highlights basic time and algorithm signals, and reviews pasted session-cookie attributes.
Local analyzer: Runs entirely in this browser. Tokens are decoded locally and are never verified or sent.
What this checks
- JWT algorithm, issuer, audience, expiration, and not-before claims
- Expired, not-yet-valid, missing-expiry, and alg=none signals
- Secure, HttpOnly, and SameSite attributes in pasted Set-Cookie values
What this cannot prove
- It decodes JWT data but does not verify the signature, issuer, audience, key, or revocation state
- Decoded claims are untrusted input and do not prove a session is valid
- Use only non-production tokens; this page does not inspect server-side session behavior
Primary references
Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.
Need an app-wide assurance record?
LyraShield AI adds authorized target scanning, explicit coverage receipts, evidence states, approval-gated fix proposals, server-owned retests, and immutable reports. This browser tool remains guidance, not a security guarantee.
Get product updatesFrequently asked questions
Does this upload my input?
Tokens are decoded locally and are never verified or sent.
Does a clear result mean my app is secure?
No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.