JWT Security Checker
Audit a JWT for alg none, missing expiry, long lifetimes, missing audience, embedded keys and sensitive claims. Free and private: runs in your browser.
Paste a token to check its header and claims against common JWT security mistakes.
Runs entirely in your browser. Code, keys and tokens are never uploaded, logged or stored.
Use cases
- Debug a 401 by checking a token's expiry, audience and issuer.
- Inspect the claims your identity provider actually sends.
- Create test tokens for local API development.
Frequently asked questions
What claims should every access token have?
At least exp (short, minutes not days), iat, iss and aud. Servers should verify the signature, issuer, audience and expiry on every request.
Is the JWT Security Checker free?
Yes. It is free with no sign-up, and it runs entirely in your browser, so your input is never uploaded or stored.
Does a clean result mean my code is secure?
No. It means none of the common patterns this tool looks for were found in the snippet. Combine it with code review, dependency scanning and a full repository scan.
Related tools
Catch secrets, injection and unsafe code in every pull request with CodeInspector.