JWT Inspector
API & BackendDecode a token and audit its claims, expiry and signature settings.
Runs entirely in your browser — nothing is uploaded
Features
- Security audit covering alg: none, weak algorithms and missing claims.
- Lifetime analysis with warnings for over-long expiry windows.
- Every registered claim explained in plain English.
- Optional signature verification when you supply the secret.
How to use the JWT Inspector
- 1Paste the token to inspect.
- 2Read the audit findings and claim table.
- 3Optionally enter the secret to verify the signature.
Frequently asked questions
What is the "alg: none" attack?
A forged token declares no algorithm and drops the signature. Servers that trust the header field accept it. Always pin the expected algorithm server-side.