JWT Security Inspector

This reads a token's header and claims and reports what they say about the system that issued it. It does not verify the signature, resolve a key, or contact the issuer — a page running in your browser has none of those, and a report implying otherwise would be worse than no report.

That is a narrower job than the name suggests, and it is still a useful one. A great deal of how a JWT deployment is configured is visible in the token itself.

What the header gives away

An alg of none means the token is unsigned and every claim in it is unauthenticated. A symmetric algorithm means the key that checks the token is the key that mints them, so any party able to verify is also able to issue. And jku, jwk, x5u or x5c mean the token is nominating the key used to check it — legitimate in some federated designs, and a problem wherever a verifier honours them without pinning the source.

What the claims give away

A missing exp is a token that never expires on its own. A missing aud is a token nothing restricts to one service, which matters when several share a signing key. A missing jti is a token that cannot be revoked individually. None of these is automatically wrong; each is a decision, and the report says which ones were made.

Credentials in the payload

A JWT is signed, not encrypted. Every claim is readable by anyone holding the token — including each intermediary it passes through and anything that logs a request header. Claims whose names or values look like key material are flagged by name only: the value is the exposure, and printing it into this page, your clipboard and your scrollback would compound that rather than report it.

What it will not do

Every finding states what the token shows and why it matters. None describes how to exploit it. This publication reports on weaknesses; it does not publish the next step.

The sample is an unsigned token carrying a claim named api_key. It draws two critical findings: the missing signature, and a credential sitting in a payload that anyone holding the token can read. The second is the one people are surprised by, and it is the more common of the two in real systems.