Question 1

Is it safe to paste a JWT here?

Accepted Answer

The token never leaves your browser. Decoding, checks, and signature verification run locally with the Web Crypto API. Avoid pasting production tokens on shared computers.

Question 2

What security issues does the analyzer detect?

Accepted Answer

It flags alg none, weak or guessable HMAC secrets from a small wordlist, missing or distant expiry, tokens that are not yet valid, sensitive data in claims, and header fields such as jku, x5u, and kid that attackers often abuse.

Question 3

Can this verify a JWT signature?

Accepted Answer

Yes for HS256, HS384, and HS512 when you provide the secret. Verification uses the Web Crypto API in your browser.

Check	Flags
Algorithm	alg none, missing alg, algorithm confusion between RS256 and HS256
Weak secret	HMAC secret found in a wordlist of common defaults
Lifetime	Missing exp, expired tokens, lifetimes over one day or 30 days
Header injection	jku, x5u, jwk headers and kid values that look like paths or SQL
Claims	Missing iss, aud, sub, jti, and sensitive or authorization data in the payload

JWT Decoder & Analyzer

How it works

Frequently asked questions

Start testing in minutes