JWT Security Analyzer
Paste a JWT to decode its header and payload and flag risky settings like alg none or missing expiry.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
JWT Security Analyzer
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
A sample token with alg none and a future exp is decoded and flagged as critical for the none algorithm, with its expiry shown.
What this tool does not do / Limits
This tool only decodes and flags a token you paste. It does not verify the signature and never trusts the token. Never paste a real production token or secret here.
Frequently asked questions
Does decoding prove the token is valid?
No. Decoding only reads the token; only a separate signature verification can show it was signed by the expected key.
Why is alg none flagged?
Because a none token has no signature, so anyone could have produced it.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live