MSRXTools / Developers
JWT decoder & auditor
Decode a JSON Web Token and flag the risky parts: alg none, expired or missing exp, long lifetimes and sensitive claims.
Runs in your browser
Loading tool…
Good to know
- Anyone holding a JWT can read its payload. Never put secrets or personal data in it.
- Short exp, a fixed list of allowed algorithms on the server, and a checked aud claim prevent most JWT attacks.
- Only HMAC (HS*) signatures can be verified here, using the shared secret.
Related tools
Hash & checksum generator
SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.Leaked secret finder
Paste code, logs or config and find API keys, tokens and private keys before you commit or share them.Encoder & decoder
Base64, Base64URL, URL, HTML entities and hex, both ways. Handy for reading suspicious payloads safely.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.
SHA-1, SHA-256, SHA-384 and SHA-512 of text or a file, plus checksum verification for downloads.Leaked secret finder
Paste code, logs or config and find API keys, tokens and private keys before you commit or share them.Encoder & decoder
Base64, Base64URL, URL, HTML entities and hex, both ways. Handy for reading suspicious payloads safely.Website vulnerability scanner
Paste a URL. Get a SWOT security report scored out of 10: HTTPS, TLS, headers, cookies, content, DNS and email, with fixes.