Your files stay on your device

JWT security analyzer

Paste a JWT and get graded findings for the defect classes that make tokens forgeable, with Unknown kept for anything undeterminable.

Paste a token to grade it.

This page never verifies a signature, on purpose. Decoding and verification answer different questions, and mixing them makes people think they checked something they did not. A clean report is not a safe verdict either: most JWT vulnerabilities live in the verifier code, which no token analyzer can see. Signature checking lives on the JWT Decoder page with a local key you provide.
Options

More web & auth tools

- JWT decoder (/web/jwt)
- Authorization header (/web/auth-header)
- CSP evaluator & builder (/web/csp)
- Subresource integrity (/web/sri)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/jwt-security-analyzer
Markdown version: https://nutter.tools/web/jwt-security-analyzer.md
Plain-text version: https://nutter.tools/web/jwt-security-analyzer.txt
Agent index: https://nutter.tools/llms.txt