Token Security
Decode a JWT and see what's wrong with it.
Paste a token to see its header, payload, and the security weaknesses that matter: unsigned tokens, missing expiry, over-long lifetimes, and sensitive data sitting in a payload anyone can read.
Decoded entirely in your browser. The token is never sent to us or anyone else.
- Decoding happens in your browser — the token is never transmitted.
- Signature verification is deliberately excluded; it would require your signing key.
- Checks map to common JWT failure modes seen in real assessments.
Want this done properly, across your whole estate?
A free tool finds the obvious. Our team finds what it misses.