Your files stay on your device

# JWT security analyzer

Paste a JWT and get graded findings for the defect classes that make tokens forgeable, with Unknown kept for anything undeterminable.

Paste a token to grade it.

This page never verifies a signature, on purpose. Decoding and verification answer different questions, and mixing them makes people think they checked something they did not. A clean report is not a safe verdict either: most JWT vulnerabilities live in the verifier code, which no token analyzer can see. Signature checking lives on the JWT Decoder page with a local key you provide.
Options

## More web & auth tools

- [JWT decoder](/web/jwt)
- [Authorization header](/web/auth-header)
- [CSP evaluator & builder](/web/csp)
- [Subresource integrity](/web/sri)
[All web & auth tools](/web)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/web/jwt-security-analyzer
Markdown version: https://nutter.tools/web/jwt-security-analyzer.md
Plain-text version: https://nutter.tools/web/jwt-security-analyzer.txt
Agent index: https://nutter.tools/llms.txt