Web Security

JWT Security Auditor

Audits a JWT for alg none, missing or excessive expiry and sensitive claims - without verifying the signature.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste a single JWT - the three dot-separated parts.
  2. Select Audit token.
  3. Read the algorithm and expiry findings first; those are the ones that get a bad token accepted.
  4. Remember the signature was not checked. A clean report means the readable parts are fine, not that the token is authentic.

What jwt security auditor does

A JSON Web Token can be structurally perfect and still be a problem. An "alg" of none means the server may accept it with no signature at all. A missing expiry means a stolen token never lapses. Secrets dropped into the payload are readable by anyone, because a JWT payload is encoded, not encrypted. These are posture questions, not decoding questions.

Paste a token and this reads its header and payload and reports on those risks: the algorithm, the expiry and timing claims, and any claim whose name suggests a secret. It deliberately does not verify the signature - that needs the signing key, which should never be pasted into a web page - and the report says so plainly. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

No, and that is deliberate. Verifying a signature needs the signing secret or public key, which should never be pasted into a web page. The tool audits the readable header and payload only, and the report says the signature was not checked.

It means the token declares no signature algorithm. A server that honours this accepts a token with no signature at all, so a forged token passes. Any verifier must reject alg none; the tool flags it because it is the classic JWT bypass.

Only data you are willing for the holder to read. A JWT payload is base64-encoded, not encrypted, so anyone with the token can decode it. The tool flags claim names that look like secrets for that reason.