Tool · client-side · no signup
Bearer Token Inspector.
Paste a full `Authorization: Bearer ...` header (or just the token). The tool detects whether it's a JWT, an opaque token, or something else; decodes JWTs; flags suspicious patterns. Client-side; never sent anywhere.
Paste a full `Authorization: Bearer ...` header, or just the token. Detection + decoding happens entirely in your browser.
Triage appears here
Paste an Authorization header. The tool detects whether it’s a JWT, opaque token, PASETO, or other.
What this is good for
Typical use cases.
Quickly identify what type of token your API got
Triage an Authorization header from a captured HTTP request
Educate a junior developer on what each token type contains