alekseialeinikov.com

analyze_jwt

Decode a JSON Web Token and audit it like an attacker would: alg none, well-known HMAC secrets, algorithm confusion, injected jwk/jku/kid headers, missing exp/iss/aud, long lifetimes, secrets or PII in claims. Optionally verifies the signature with a key. Returns a grade A-F, decoded claims and findings with fixes. Runs locally with Web Crypto; nothing is uploaded or echoed into links.

Page: /en/tools/

Input schema

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "description": "The JWT (JWS or JWE). A \"Bearer \" or \"Authorization:\" prefix is fine."
    },
    "key": {
      "type": "string",
      "description": "Optional: HMAC secret, PEM public key, X.509 certificate or JWK/JWKS JSON to verify the signature. Never pass a private key."
    }
  },
  "required": [
    "token"
  ]
}