JWT Inspector

A decoder reads the header and payload of a JWT and shows the raw claims. The JWT Inspector goes further: it audits the token for security problems — the notorious alg:none vulnerability, missing or expired exp claims, future-dated nbf/iat claims, key-injection headers (jku, x5u), sensitive claims, missing audience/issuer, and oversized payloads — and scores the result from 0 to 100 with a clear verdict. It also shows a live countdown to expiry so you can see at a glance whether a token is currently usable.

No — everything runs 100% locally in your browser. The token is parsed and analyzed with plain JavaScript in your tab; nothing is ever sent to a server. Treat tokens from production systems with the same care you would give a password, since a JWT payload can contain sensitive claims, but the inspection itself happens entirely on your device.

The header of a JWT declares its algorithm, and some libraries trust that declaration. An attacker who strips the signature and sets "alg":"none" can forge arbitrary claims if the server naively accepts unsigned tokens. The Inspector flags alg:none and missing-signature tokens as Critical, and any correctly configured server must reject them outright.

The score starts at 100 and drops for each finding: critical findings remove 40 points, warnings 15, and informational notes 3, with a floor of 0. The verdict summarizes the worst finding: Critical Issues Found, Review Recommended, or Looks Good. The score is a heuristic, not a guarantee — a high score means no obvious red flags in the token itself, while server-side validation and key handling are always your responsibility.

If the payload has an exp (expiration) claim, the Inspector shows a live ticking HH:MM:SS countdown and turns amber when less than five minutes remain. The Time Claims panel also shows exp, nbf (not before), and iat (issued at) as readable local dates with relative labels. A token whose exp has passed must be rejected by the server; one whose nbf is in the future is not yet valid.

jku (JWK Set URL) and x5u (certificate URL) tell the verifier where to fetch the signing key. If a server follows these URLs without strict allow-listing, an attacker can point them at their own key and forge tokens — a key-confusion attack, so the Inspector warns on both. kid (key ID) is normal and safe when the server resolves it against a trusted key set, so it is reported as informational guidance.

No — signature verification with a shared secret is what the companion JWT Decoder does (HS256/HS384/HS512 via Web Crypto). The Inspector focuses on the structural and security analysis of the token itself, which requires no secret. For asymmetric algorithms (RS256, ES256, etc.) verification always needs the issuer public key, which neither tool can guess.

Yes — completely free, with no registration, no sign-up, no premium tier, and no data collection. Parsing, scoring, and the live countdown all run locally on your device. Pair it with our JWT Decoder, JSON formatter, and hash generator for a complete developer toolkit.