JWT inspector
Decode a JSON Web Token, check it against the JWT best current practices and verify its signature with your key. The token never leaves this page.
Inspect a token
Paste a JWT to decode its header and claims and check them against the JWT best current practices (RFC 8725). Add the key to verify the signature.
Your token stays in this browser. It is decoded and checked by code on this page, never sent or stored, and the site’s Content Security Policy lets the page connect only to this site. A live token is still a credential: prefer an expired or test token.
Loading the local inspector… If this remains visible, refresh the page.
Token report
| Finding | Severity | Why it matters and what to do |
|---|
Registered claims
| Claim | Value | Meaning |
|---|
Header
Payload
What is checked
- The algorithm: alg none, a missing or unregistered alg, HMAC algorithms and the key-confusion risk, and the deprecated polymorphic EdDSA name
- HS256, HS384 and HS512 signatures against a short built-in list of well-known secrets (such as secret, changeme and documentation examples), computed in the page with Web Crypto
- Headers that bring keys or key locations with the token: jku, x5u, jwk and x5c, and kid values that look like paths, SQL, URLs or control characters
- crit, b64 and zip, and explicit typing with typ (RFC 9068 at+jwt access tokens and their required claims)
- Time claims: missing or expired exp, nbf and iat in the future, missing iat and long lifetimes, with a 60-second clock allowance
- Missing aud and iss, and both against the audience and issuer you expect
- Claim names that suggest secrets or personal data in a readable token
- The signature, with your key: HS256/384/512, RS256/384/512, PS256/384/512, ES256/384 and Ed25519 (EdDSA)
Source specifications
Guides and practice
All toolsDefend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
JWT validation: algorithms, keys, claims and key rollover
Validate a JWT against a fixed algorithm, trusted keys and the expected issuer, audience and type, reject the known header attacks, and rotate signing keys without accepting arbitrary keys or breaking valid tokens.
Session management: cookies, timeouts, rotation and revocation
Model authentication as transitions in server authority, set session cookies and timeouts to current NIST and OWASP values, and verify fixation prevention, expiry, reauthentication, revocation and stolen-cookie defenses.
JWT validation lab: Validate the purpose and audience of a token
An API accepts a correctly signed token intended for another service. Repair claim validation after the trusted signature verifier has finished.