Chrome extension · Manifest V3 · MIT

Decode any JWT
in a blink -
it never leaves
your browser.

Paste a token and Jotscope decodes it instantly into a readable, colour-coded claim view. No servers, no tracking, no network calls. The source is what ships.

Add to Chrome View source

Offline by default. The only request it can make is an opt-in fetch of an issuer's public keys - off unless you turn it on.

Jotscope paste → decode
A JWT is three parts - Jotscope reads all of them
eyJhbGciOiJSUzI1NiIsImtpZCI6IjA3YSJ9.eyJzdWIiOiJ1c3JfODQyIiwicm9sZSI6ImFkbWluIn0.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
header - alg & kid payload - the claims signature - verify, don't trust
Offline by default One permission Zero runtime deps No tracking, ever Open source (MIT)

See it in action

The whole thing, in twenty seconds.

Paste, decode, verify - a quick narrated tour. Sound on if you like.

What it does

Not just base64-decoded. Actually readable.

Every claim is typed, explained, and colour-coded - the way you'd read a token if you had the time.

Visual claim view with tooltips, chips and type colours

Claims in plain English

Colour-coded by type, with hover & keyboard tooltips (RFC 7519 + OIDC + vendor). scope, groups and roles render as chips.

Nested claims, unravelled

Keycloak's realm_access, Firebase's identities and other deep payloads render as a collapsible tree - recursive, any depth - instead of a wall of JSON.

Token lifecycle: Valid to Expiring to Expired

Live token lifetime

A real-time countdown and an issued → expires bar. Watch the status shift Valid → Expiring → Expired as the clock runs down.

Signature verification with an alg:none warning

Signature, honestly opt-in JWKS

Clear verification states, including a prominent warning for unsigned alg: none tokens. Fetching the issuer's keys is the one network call - and only when you ask.

Multiple tokens detected from a callback URL

Finds tokens anywhere

Paste a whole OAuth callback URL or a blob of text and Jotscope pulls the tokens out for you - with a picker when there's more than one.

Privileged admin role highlighted

Privileged roles, flagged

admin, superuser or any *-admin is tinted and bolded, so a dangerous grant jumps out instead of hiding in the payload.

The whole point

Your tokens never leave your browser.

Tokens carry identities, sessions, and secrets. Decoding one shouldn't ship it to someone's server. Jotscope does everything locally - and the code is small, vanilla, and unminified, so you can check that yourself.

Decoding is 100% local

Parsing and rendering happen entirely in the popup. No analytics, no telemetry, and zero runtime dependencies.

Clipboard, only on request

Read only when you click Paste or press Ctrl/Cmd+V - never on open, in the background, or on a timer.

Stays on your machine

History & settings live in your browser's localStorage - never synced, never sent. Cap it, clear it, or turn it off.

One opt-in network call

Signature verification can fetch an issuer's public JWKS - the single possible outbound request, off by default, and it sends no token data.

clipboardRead

The only permission Jotscope requests. No host permissions, no <all_urls> - it can't see the pages you browse. Just the clipboard, and only on an explicit paste.

Made for developers who live in tokens.

Free, open source, and offline by default. Pin it to your toolbar and never paste a JWT into a website again.

Add to Chrome Star on GitHub