JWT Security Check
Paste a JSON Web Token and get its header and payload decoded instantly, plus every common security misconfiguration flagged: alg: none, embedded key headers, algorithm-confusion risk, a suspicious kid, timing-claim problems, and sensitive-looking payload fields.
No signature verification, no upload. This tool never asks for a key and never verifies a signature -- it only decodes the header/payload (no key needed for that) and checks them against a documented list of misconfiguration patterns. A finding is something worth a look, not a verdict, and a clean result is not a guarantee your token or server is secure.
1. Paste your JWT
The full header.payload.signature string. Nothing here is uploaded -- everything runs in this page.
Decoded
Header
—
Payload
—
Findings
Paste a JWT above, or load the example, to see findings.
Usage is optional, stays in this browser, and counts only that a check ran or a summary was copied. The token you paste, its decoded contents, and every finding are never recorded, uploaded, or sent to an analytics service. Uncheck to turn it off. Do Not Track and Global Privacy Control disable counting automatically.
Common questions
Does this tool verify the JWT's signature?
No, and it never asks for a key to do so. It only decodes the header and payload (which need no key -- they are base64url-encoded, not encrypted) and checks them for documented misconfiguration patterns. Verifying a signature requires the actual signing key or public key, which this tool never requests, stores, or needs.
Is my token uploaded anywhere?
No. Every check runs entirely in your browser, in JavaScript. The token you paste, its decoded contents, and every finding never leave your device -- there is no server-side processing and no third-party analytics vendor.
What does alg: none mean and why is it flagged?
"none" is a real, spec-defined algorithm value (RFC 7518) for an explicitly unsigned token. A verifier that accepts it treats the token as valid with no signature check at all -- a well-documented forgery technique, since anyone can hand-craft a header and payload and set alg to none. This tool flags it as high severity whenever it appears.
Is a clean result a guarantee the token or my server is secure?
No. Every check here is a structural, pattern-matching signal against a documented list of known failure shapes -- not a full security audit, and not a claim about your verifying code, which this tool never sees. A token with zero findings can still be misused by an insecure verifier, and a token that trips a finding can still be handled safely by correct verification code. Read every finding as worth a look, not a verdict.