JWT & Token Security Analyzer
Paste a JSON Web Token to decode it and surface security weaknesses —
alg=none, weak HMAC secrets, key-injection headers, sensitive data, expiry.
Everything runs in your browser. The token never leaves your device.
Expected claim checks
Compares decoded claims only. A match does not verify the signature or establish token validity. See Signature check below.
Decoded
Header
Payload
Signature
Security findings
Claims
| Claim | Value | When |
|---|
Signature check
This token uses an HMAC algorithm (). Test whether it was signed with a common/weak secret:
This token uses an asymmetric algorithm (). Paste the signer's public key (PEM) to verify:
No signing algorithm to verify.
🔒 100% client-side · no network requests · no analytics · open source.