What the JWT inspector checks
The inspector reads a token and flags things that deserve a second look. It does not need a key, so it works on any token you can copy.
- Algorithm: alg none, a missing alg, or a shared-secret algorithm.
- Expiry: a missing exp, an expired token, an nbf that is still in the future, or times written in milliseconds.
- Lifetime: tokens that stay valid for days or months.
- Header fields: jku, jwk, x5u and x5c, which let a token point to its own key, and kid values with unsafe characters.
- Claims: missing iss, aud or sub, claim names that look like passwords or keys, and personal data.
- Size: tokens too large for a cookie.
How to read the report
Risks are the most serious findings, warnings are worth checking, notes are advice, and good means a check passed. A clean report does not prove a token is safe, because the inspector does not verify the signature. To check the signature use the JWT decoder.
Common problems
- Accepting alg none, or letting the token choose which key to trust.
- Tokens with no exp that never expire.
- Putting secrets or personal data in the payload, which anyone holding the token can read.
- Not checking iss and aud on the receiving side.
Next steps
See every claim explained in the claims decoder, check dates with the expiration checker, and read the safety rules in the JWT guide.