JWT Security Checker
Decodes a JWT's header and payload (without verifying its signature) and flags common security issues, like an "alg" of "none", a symmetric signing algorithm, or a missing expiry claim.
Decodes a JWT's header and payload (without verifying its signature) and flags common security issues, like an "alg" of "none", a symmetric signing algorithm, or a missing expiry claim.
Use cases
- Reviewing a JWT before relying on it in a security-sensitive flow
- Checking whether a token includes an expiration claim
Examples
An HS256 token with no exp claim
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c
{"header": {"alg": "HS256", "typ": "JWT"}, "claims": {"sub": "1234567890", "name": "John Doe", "iat": 1516239022}, "issues": ["alg is 'HS256' - a symmetric algorithm; ensure the signing secret is strong and kept server-side", "missing 'exp' claim - token never expires"]}FAQ
Is my data sent to a server?
Yes — the decoding runs on the server for this tool.