Why a batch decoder
Debugging one token is a solved problem — jwt.io does it well and everyone links to it. The work that actually costs time is a different shape: an incident where a client is sending 300 tokens and you need to know which ones are stale, an integration where half the requests fail because a clock is skewed, or a log dump where you suspect a service is still issuing tokens with alg: none. Pasting those one at a time into a single-token debugger is the bottleneck, and the tools that do handle batches are mostly unnamed single-page sites with a plain textarea.
So this page is built around the batch, not around one token:
- Status, not just JSON. Every token is classified as valid, expired, not yet valid (nbf in the future) or malformed, with the reason attached. Duplicates are collapsed and counted.
- Security notes per token. alg: none, a missing exp (never expires), validity longer than a year, iat later than exp, and missing iss/aud are called out explicitly — the things a pretty-printer will not tell you.
- Export that matches the shape of the data. Row-aligned CSV for a spreadsheet, structured JSON for a script — not a copy-paste of one decoded blob.
- Offline by design, and honest about it. HS256/384/512 signatures can be verified locally with a secret you paste in. RS/ES verification requires fetching a JWKS, which would mean leaving the browser, so the tool refuses and says so per token rather than showing a green check it has not earned.
Tokens are split on newlines, commas, semicolons or spaces, so you can paste a column out of a log file or a spreadsheet directly; lines starting with # are ignored as comments. Nothing is sent anywhere: there is no backend, no analytics on your input, and no share link that would persist a token on a server — which matters, because a JWT is a bearer credential.