Cybersecurity · free, no signup
JWT Safety Inspector
Paste a JWT to decode its header and claims locally and see what a verifier would accept. Reports unsigned tokens, algorithm confusion, missing expiry, unbound audience, key-fetch headers that turn validation into request forgery, and secrets left readable in the payload. Signatures are never verified — that needs the issuer's key, which this tool never asks for, and the result says so rather than implying authenticity.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste a JSON Web Token to decode its header and claims and see what a verifier would accept. The token is decoded on the server and never stored — only a hash is kept for rate accounting.
The signature is not verified. Verification needs the issuer’s key, and no tool should ask you to paste a signing secret. A token can look correct here and still be forged — check the signature in your own environment.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The API Penetration Testing engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore API Penetration Testing