JWT Security Check

Audit algorithm, signature, claims, and header risks with weak-secret cracking

JWT Token

Expected algorithm (optional)

Key format

Secret / Public key (optional, for verification)

Expected iss (optional)

Expected aud (optional)

Custom dictionary (optional, one per line)

Result

—

What is a JWT security check?

A JWT decoder only turns the token back into readable content and performs no validation. A security check actually recomputes the signature with your key, then inspects the algorithm, claims, and header extensions to point out anything that can be forged, escalated, or injected — with fix advice for each finding. Everything runs locally in this browser and your token is never uploaded.

Check layers

Algorithm/alg none without a signature, missing or unknown algorithm, mismatch with the expected algorithm
Signature/HMAC and public-key verification, empty signature, short secrets, algorithm confusion via a public key used as an HMAC secret
Claims/exp, nbf, and iat timing anomalies, missing or mismatched iss and aud, leaked sensitive fields
Header extensions/jku and x5u external key URLs, an embedded jwk, kid injection, crit extensions

Note· Use this tool to audit tokens you issued yourself. Signature verification and weak-secret cracking run entirely in this browser and nothing is sent to any server.

Author's Blog