// TOOLS

Security Tools

🔓 JWT Decoder & Analyzer

Decodes the header and payload, explains the claims and audits the token: alg=none, algorithm confusion, external keys (jku/x5u), expiry, injectable kid, sensitive data and —if HS256— whether it is signed with a weak secret. The token never leaves your browser.

Frequently asked questions

Does it verify the token signature?

It decodes the header and payload without needing a key. It also audits the token and tests weak HS256/384/512 secrets by computing the HMAC in the browser against a wordlist.

Is it safe to paste my token here?

The token is processed in your browser and not sent to any server. Even so, do not share production tokens and treat them as credentials.

What issues does it detect?

alg=none, an expired or never-expiring token, inconsistent nbf/iat, a potentially injectable kid, sensitive data in the payload and authorization claims.