JWT decoder + audit
Paste a JWT. We decode it client-side (the token never leaves your browser unencrypted) then audit the claims for common security issues: alg=none, weak algorithms, missing exp/aud/iss, leaked PII.
The JWT Decoder + Security Audit reads the header and payload of any JSON Web Token, then runs the same checks a security reviewer would on a code review: is the algorithm safe, are the expected claims present, are the lifetimes sane, is sensitive data being leaked?
Decoding happens client-side using the standard base64url encoding — your token's signature never leaves the browser. The audit step only sends the decoded header and payload (not the signature) to our server, which never logs the content. The result is a structured report with severity ratings you can act on.
Frequently asked
Does my token's signature get sent to your server?
No. Decoding runs client-side. Only the decoded header and payload are sent for analysis. The signature stays in your browser.
Can you verify the signature?
Not without the secret/public key, which we never want. Use this tool for inspection, not verification.
What does "alg=none" mean and why is it dangerous?
It means the token is unsigned — anyone can forge one. Production servers must always reject alg=none and enforce an algorithm allowlist.