JWT Debugger Pro

It performs a full security audit: checks for the 'none' algorithm (completely unsigned tokens), expiry validation (past, near-future, or overly long), missing audience (aud) and issuer (iss) claims (which enable token substitution attacks), missing JWT ID (jti) for replay prevention, sensitive data in the payload, and algorithm-specific security notes for HS256 vs RS256 vs ES256.

When algorithm is 'none', the JWT has no signature — it's completely unsigned. A vulnerable server that accepts alg=none will trust any token regardless of its content. An attacker can create a token with any user ID or role by simply setting alg to none and removing the signature. Always validate that the algorithm matches what your server expects, never accept alg=none from clients.

In an algorithm confusion attack, an attacker changes a token's algorithm from RS256 (asymmetric) to HS256 (symmetric) and re-signs the token using the server's public key as the HMAC secret. If the server doesn't enforce the expected algorithm, it verifies the HMAC signature using its public key — which the attacker already has. Prevention: always specify and enforce the expected algorithm when verifying JWTs.

JWT payloads are Base64URL-encoded — this is encoding, not encryption. Anyone who possesses the token can decode and read its contents without any key. This includes passwords, credit card numbers, SSNs, and PII. If sensitive data must travel in a JWT, use JWE (JSON Web Encryption) instead of plain JWT. For standard auth JWTs, include only the minimum necessary claims (sub, roles, exp).

Both are asymmetric algorithms (private key signs, public key verifies), but they use different cryptographic primitives. RS256 uses RSA with 2048+ bit keys. ES256 uses ECDSA with P-256 curve (256-bit keys). ES256 tokens are smaller, ES256 operations are faster, and P-256 keys provide equivalent security to RSA-3072. ES256 is the recommended modern choice for new systems.

This tool runs 100% in your browser — your token is never sent to any server. However, as a best practice, avoid pasting production tokens that grant admin access to sensitive systems. For security-critical debugging, consider using a local tool or the jwt.io site on a private network. Rotate tokens after sharing them for debugging.