JWT Vulnerability Scanner

Paste a JSON Web Token and review its structure for common risk indicators. The analysis runs entirely in your browser: the token never leaves your device.

Free, no sign-up or install
The analysis runs in your browser
This tool does not send what you enter to any server

Responsible use

Use these tools only on domains, addresses or credentials you own or are expressly authorised to assess. Their use is the sole responsibility of the person using them.

JSON Web Token

Paste the full token, including the signature. Analysis runs entirely in your browser; the token never leaves your device.

I understand a JWT may contain personal data or secrets, and that this analysis runs only in my browser.If the token uses HMAC (HS256/HS384/HS512), test in my browser whether the signature matches common secrets from a short dictionary.

What is this token primarily used for?

Session or user authentication in productionService-to-service API in productionDevelopment, testing or exampleI do not know

What is the maximum lifetime you consider acceptable for this type of token?

15 minutes1 hour24 hoursI do not know, use the recommended value (1 hour)

Do you want to paste the public key (PEM or JWK) to check whether your backend could be susceptible to algorithm confusion? The key never leaves your browser either.

Would your tokens hold up against a real attacker?

This analyzer reviews the token structure and flags risk indicators, but the serious flaws usually live in how your backend issues and validates JWTs. At Secra we test your API authentication the way a real attacker would: algorithm confusion, alg:none, weak secrets, SSRF via jku/x5u and token replay. You get an actionable report with prioritized findings and concrete remediation, ready for your development team.

Request an API and token audit