Advanced JWT diagnostics
JWT Security Analyzer
Inspect a JWT for policy-sensitive security signals such as alg=none, unexpected algorithms, token-controlled key URLs, suspicious kid values, time claims, issuer and audience mismatches.
JOSE header policy
What this analyzer does — and does not prove
The analyzer applies deterministic checks to the decoded JOSE header and claims. Algorithm allowlists, expected issuer, expected audience and maximum lifetime are application policy, so the strongest checks only run when you provide those expectations.
A clean report is not cryptographic verification. Use a trusted key or JWKS to verify the signature before treating claims as authentic.
Analysis runs in your browser. Avoid live production bearer tokens when a synthetic token can reproduce the issue.
Related advanced tools
JWT Diff
Compare two JWTs field by field to see what changed in the decoded header and payload after refresh, login, environment changes or key rotation.
OIDC Discovery Checker
Check OpenID Connect or OAuth authorization-server metadata from an issuer URL, validate exact issuer matching and inspect JWKS and endpoint metadata in your browser.
JWK Inspector
Inspect a single JSON Web Key, identify key type and usage metadata, detect private key material and compute an RFC 7638 SHA-256 JWK thumbprint locally.