JWT Security Inspector
Decode JWTs, inspect expiry, issuer, audience, algorithm choices, and common token security mistakes.
What is JWT Security Inspector?
Inspect decoded JWT claims for timing and expected issuer/audience mismatches. The signature remains unverified, so matching claims never prove that a token came from a trusted issuer.
How to use JWT Security Inspector?
Step 1
Paste a JWT token into the inspector.
Step 2
Optionally enter expected issuer and audience values.
Step 3
Review expiry, algorithm warnings, claims, and the security checklist.
Example input / output
An audience claim may be "api" or ["api","reports"]. Match the expected recipient against either representation. Review an alg=none token as unsigned, rather than treating its readable payload as trustworthy.
Example input
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjMiLCJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJhdWQiOlsiYXBpIiwicmVwb3J0cyJdLCJleHAiOjE3MDAwMDAwMDB9.Check the result
- Decoding a JWT does not verify its signature; production APIs must verify signatures server-side.
- Never share live bearer tokens in screenshots, tickets, or public issue trackers.
Practical developer examples
Separate algorithm from verification
The algorithm name is supplied by an untrusted header. The server must allow only configured algorithms and verify using trusted keys.
Check timing and recipient
Review exp, nbf, issuer and audience together. Use the verifier's defined clock tolerance; do not extend expiry merely because a client clock differs.
Common developer use cases
No keys, signatures or authorization rules are verified. HS256 is not inherently insecure; secret strength, key handling and algorithm policy determine its safety.
Common issues
FAQ
Can this verify my JWT signature?
No. Use a trusted server-side verifier with the issuer's keys.
Can audience be an array?
Yes. The expected audience must match one of its string values.