← All Tools
JWT Security Analyzer
Decode, analyze, and test JWTs for security vulnerabilities. All processing happens in your browser.
Authorized use only. Use this tool only on tokens you own or have explicit authorization to test.
1. alg:none Bypass
Removes the signature and sets algorithm to "none". Exploits servers that don't validate the algorithm field.
Fix: Always validate the algorithm server-side. Use an allowlist of accepted algorithms.
2. Algorithm Confusion (RS256 → HS256)
If the server uses RS256 (asymmetric), an attacker can switch to HS256 and sign with the public key as the HMAC secret.
Fix: Never accept HS256 when expecting RS256. Use separate key objects per algorithm.
3. kid Header Injection
The "kid" (Key ID) header can be exploited for SQL injection or path traversal if not sanitized.
Fix: Never use kid directly in file paths or SQL queries. Validate against an allowlist of known key IDs.
4. JKU / JWK Header Embedding
Injecting a jku (JWK Set URL) or jwk (embedded key) header can trick servers into using an attacker-controlled key.
Fix: Never trust jku/jwk from the token header. Only use pre-configured key sources.