JWT decoder and security checker
Decode tokens, read their claims in plain language, and catch the mistakes attackers look for: unsigned tokens, missing expiry, sensitive claims and well-known signing secrets.
Decoding and checks run in your browser. The token is never sent anywhere.
Paste a token to see its header, claims, timing and security findings.
Create a test token
Sign a payload with HS256 to test your own API locally. Use a throwaway secret, never a production one.
What this checks
- Algorithm:
alg: none, empty signatures, and key-location headers (jku,x5u,jwk) that a server must never trust from the token itself. - Lifetime: missing or long expiry, tokens issued in the future, and tokens not yet valid.
- Scope: missing audience and issuer claims, which let a token for one service be replayed against another.
- Privacy: passwords, card numbers and identity numbers in claims. A JWT payload is encoded, not encrypted.
- Weak secrets: HS256, HS384 and HS512 signatures are tested against secrets copied from tutorials and framework defaults.
Want to practise? Endpoint Client includes a practice login that issues a deliberately weak token. Learn the full topic in the API security course.