JWT / Token Security Analyzer
Client-Side · Real Web CryptoDecode a JWT and audit it — including a real in-browser weak-secret test
Runs entirely in your browser — the token and any wordlist you paste never leave this page and are never logged.
What this can and can't do: the decoding, checks and HMAC secret test are all real and run locally. The weak-secret test tries a bundled list of default and common secrets, plus any wordlist you paste — it can catch a guessable secret, but it cannot crack a strong, random one, and finding nothing does not prove a secret is safe. This is an educational analyzer, not a full pentest of your auth server.