JWT Decoder & Security Analyzer
Paste a JSON Web Token to decode it, verify its signature and see it the way an attacker would: forgeable algorithms, well-known secrets, injected keys, missing claims and data that never belonged in a token — each with a fix.
Runs 100% in your browser with Web Crypto. Tokens, secrets and keys are never uploaded, stored or put into the URL.
- Header27 B
- Payload118 B
- Signature32 B
Spell-check and grammar extensions are switched off for this field.
Valid for 4 years
HS256 HMAC with SHA-2566 claimsexpires in 4 yearssignature not checked
Header
algAlgorithm"HS256"HMAC with SHA-256typToken type"JWT"
Payload
subSubject"user_8f2a91"nameName"Ada Lovelace"emailEmail"ada@example.com"roleRole"admin"iatIssued at17672256002026-01-01 00:00 UTC · 4 days agoexpExpires18934560002030-01-01 00:00 UTC · in 4 years
Findings
- High
Valid for 4 years
A token cannot be taken back. Anyone who copies it from a log, a browser or a proxy keeps access for 4 years.
Fix: Access tokens: 5–60 minutes. For long sessions use rotating refresh tokens the server can revoke.
- Warning
No issuer (iss)
A verifier that trusts more than one issuer cannot tell whose token this is.
Fix: Set iss and check it against an allow-list.
- Warning
No audience (aud)
Every service that trusts the issuer accepts this token — one meant for a single API works on all of them.
Fix: Set aud to the API it is for, and have each API check it.
- Note
Shared-secret signature (HS256)
With HMAC, every service that can verify tokens can also mint them, and the secret has to be copied to each one.
Fix: Fine inside one service. With several verifiers, prefer ES256 or EdDSA and publish only the public key.
- Note
No token ID (jti)
Without jti a single token cannot be revoked, and a replay cannot be detected.
Fix: Add a random jti if you need revocation or one-time use.
- Note
Personal data: email
Email addresses are readable by anyone holding the token, and tokens end up in logs.
Fix: Carry only what the API needs; reference the user by an opaque sub.
Verify the signature
HS256Paste the HMAC secret. Paste the issuer’s public key instead to test for algorithm confusion.
What this tool checks
- Signature: verify with a secret, a PEM public key, an X.509 certificate or a JWKS — all with Web Crypto
- Forgery: alg none in any spelling, stripped signatures, more than 100 well-known HMAC secrets, algorithm confusion
- Header injection: embedded jwk, remote jku / x5u, kid path traversal, x5c, crit
- Claims: missing exp, iss, aud and jti, long lifetimes, NumericDate bugs (strings, milliseconds), clock skew
- Data leaks: passwords, API keys, private keys, card numbers and emails in the payload
- Parser traps: duplicate keys, padded base64, oversized tokens, short RSA keys, deprecated JWE RSA1_5
Common questions
Is it safe to paste a JWT into this tool?
Decoding, the checks and signature verification all run in your browser with the built-in Web Crypto API. The token is never sent, stored or logged, and it never goes into the page URL — you can confirm it in DevTools → Network. Still treat a live production token like a password: prefer test or expired tokens, and revoke one you have pasted anywhere you do not control.
Is a JWT encrypted?
No. A signed JWT (JWS) is base64url-encoded, not encrypted: anyone holding it can read the header and every claim. The signature only proves the token was not changed after signing. If the content must stay secret, keep it server-side or use an encrypted JWT (JWE).
What is the difference between HS256 and RS256?
HS256 signs and verifies with one shared secret, so every service that can check a token can also mint one. RS256 — like ES256 and EdDSA — signs with a private key and verifies with a public key you can publish as a JWKS. Use HS256 inside a single service; pick an asymmetric algorithm as soon as several services verify tokens.
How long should a JWT be valid?
For access tokens, 5 to 60 minutes. A JWT cannot be revoked without extra machinery, so its lifetime is exactly how long a stolen copy keeps working. Keep users signed in with rotating refresh tokens the server can revoke, not with long-lived access tokens.
What is the alg none attack?
alg none marks a token as unsigned. Libraries that took the algorithm from the token header accepted such tokens, so attackers removed the signature, set alg to none and changed the claims — sometimes with spellings like "None" or "nOnE". The fix is on the verifier: accept only an explicit allow-list of algorithms.
Can this tool crack my HMAC secret?
It only tries about a hundred secrets that are printed in documentation and tutorials — such as jwt.io’s "your-256-bit-secret" — and it does so locally. If one matches, anyone could have found it the same way: rotate it. A random 256-bit secret is out of reach for this or any brute-force test.
Heuristic checks on a single token, not a full audit of your auth. Decoding and verification use your browser’s Web Crypto; no cookies, nothing sent to a server.