The gap it fixes

JWT decoding in the IDE is not a new idea -- the long-standing option is JWT (JSON Web Token) Analyzer (75,144 downloads, free). Two things led to this plugin, checked again in September 2026:

Algorithm coverage. The incumbent verifies HS256, HS384 and RS256. This plugin verifies all twelve JWS algorithms the JDK implements: HS256/384/512, RS256/384/512, PS256/384/512 and ES256/384/512. ECDSA (the ES* family, used by most OIDC providers that moved off RSA) and RSA-PSS are the practical gaps.
A token with many claims stays readable. Header and payload each get their own scrolling panel with one row per claim, checked by an automated test (JwtDecoderPanelTest) that decodes a real 17-claim token and asserts every claim gets a row.

What the incumbent has and this plugin does not: editing claim values, a default keypair stored in Preferences, and relative-time rendering. If those matter more than algorithm coverage, it is the better tool.

Facts and pricing

Category: Security
Pricing: Free
Platform: IntelliJ-family plugin
First published: 2026-08-27
Marketplace ID: #33316
Repository: jwt-companion
Growth: ▲ +412.8% since 2026-08-18 (39→200)

Related plugins

All Security plugins

Freemium

API Security Companion

API Security

Lightweight, 100% local API-security checks for Java and Kotlin: hardcoded secrets, plaintext HTTP, TLS misconfiguration, and OWASP API Security Top 10 patterns.

A native, client-side viewer for X.509 certificates and keystores: decode a .pem, .crt, .cer, .der, .jks, .p12, or .pfx file without leaving the IDE.

185 downloadsDetails

Free

Dependency Vulnerability Companion

Dependency / SCA Security

Flags known-vulnerable dependency versions directly in pom.xml, build.gradle(.kts), package.json, and requirements.txt, matched against a vulnerability database bundled inside the plugin: zero account, zero token, zero network call, ever.

171 downloadsDetails

Free

SQL String Concatenation Companion

SQL Injection Detection

Flags SQL queries built by unparameterized string concatenation or interpolation (the classic SQL-injection shape) across Java, Kotlin, and Python, and offers a real quick-fix toward parameterization. Deliberately narrow (not a full SAST scanner like Qodana): one specific pattern, near-zero configuration, tuned hard against false positives.

145 downloadsDetails

Need a tool like this built for your codebase?Custom static-analysis rules, CI/CD integration, private plugin distribution and performance audits for IntelliJ plugins.

Work with Joel

Download and star counts as of 2026-10-18, refreshed twice daily from the JetBrains Marketplace and GitHub APIs.