JWT security linter — spot risky tokens
Paste a JWT and get a security review: the dangerous alg: none, symmetric-algorithm cautions, missing or expired claims. It checks entirely in your browser (0 uploads, works offline).
How to use it
- Paste the token (header.payload.signature).
- Read the findings, ranked by severity.
- Fix the issues in whatever issues your tokens.
FAQ
How do I check a JWT for security problems for free?
Paste it and this page decodes the header and payload and flags common risks — alg: none, a missing exp, an expired token, a symmetric algorithm — on your device with no upload and without verifying against any server.
Is it safe to paste a real token?
Yes. It is decoded entirely in your browser and nothing is transmitted or stored, which you can verify by turning off your Wi-Fi. Since a JWT often grants access, keeping it on-device is the point.
Why is alg: none dangerous?
It tells verifiers to accept the token without checking the signature, so anyone can forge one. A server should never accept none; the linter flags it as high severity.
Does it verify the signature?
No. It reviews the structure and claims for risks; it does not have your secret or key and does not confirm the signature is valid.
Limits
Decodes and reviews claims and algorithm; it cannot validate the signature or detect a stolen but otherwise well-formed token.
Related
The JWT generator signs tokens; the JWT decoder shows the full payload.
Bookmark this page (Ctrl+D, or ⌘D on Mac) or install the app — it works offline the next time you need it.