We built a desktop JWT decoder, directly accessible from the system tray :

blog.please-open.it/posts/jwt_de...

github.com/please-openi...

In Keycloak, you MUST take a look and uncheck "full scope allowed" checkbox if you use roles.
blog.please-open.it/full-scope-a...