Skip to content
— ✱ FREE TOOL · CYBER · NO SIGNUP · CLIENT-SIDE DECODE

Decode any JWT — and see the holes.

Decode any JWT and get a security audit of the token, not just its payload.

Decoded locally. The token only reaches our server when you click Run vulnerability lint below.

Try:
Submitting the form sends the token to our server for the 12-rule scan.
How this works
  • Privacy first: the decode happens in your browser. We only send the token to our server when you explicitly click Run vulnerability lint — and even then we never log it raw, only a hash.
  • What we check: 12 lint rules covering OWASP / RFC 8725 — alg=none, weak HS256 secrets, algorithm confusion, missing/expired claims, kid injection, excessive lifetime, sensitive PII in claims, and more.
  • What we don't do: verify signatures (we don't have your secret), call any external service, or train on your tokens.
  • Free-vs-signed-in: all 11 rules + decode are free. The HS256 wordlist crack runs only for signed-in users (it's CPU-heavy and abuse-prone). Save-to-history is also gated.
  • Reminder: JWTs are credentials. Don't paste production tokens into random web tools (including this one) — for real keys, run the engine locally.