JWT Inspector

What is a JWT?

A JWT, or JSON Web Token, is a token format that carries statements called claims between two parties. It can be signed or encrypted. In the common compact signed JWS form, the header, claims and signature are separated by dots; the contents can be read without a key.

Anatomy of a JWT

A JSON Web Token (RFC 7519) carries statements, called claims, between two parties. In its most common form, the compact JWS signature (RFC 7515), it has three segments separated by dots: the header, the payload and the signature. The header states the algorithm (alg) and sometimes the key to use (kid). The payload holds the claims: subject, issuer, audience, dates. The signature covers the first two segments and proves they have not been changed.

Each segment is base64url-encoded: the base64 alphabet where + and / become - and _, with no = padding. This encoding protects nothing. Anyone who intercepts the token can read it, which is why a payload should never hold a password or sensitive personal data.

How the tool works

Decoding, verification and signing go through jose, the JOSE library by Filip Skokan (panva), maintained and MIT-licensed, which builds on the browser’s Web Crypto API. On top of it, the tool adds a short list of rules that read the decoded header and claims: algorithm, expiry, key parameters, sensitive data. These rules point out risky configurations; they do not replace testing the server.

Classic attacks

alg "none"

The specification allows an unsigned token, with "alg": "none". For years, some libraries accepted such tokens whenever the header asked for it. An attacker would edit the payload, drop the signature, and the server would accept it.

RS256 to HS256 algorithm confusion

A server that verifies RS256 holds a public key. If the library lets the header choose the algorithm, the attacker signs a token with HS256 using that public key as the HMAC secret. The server verifies with the same key and accepts the forged token. The fix is to pin the expected algorithm on the server.

Weak secrets

An HS256 token lets anyone test secrets offline, with no rate limit: a single valid token is enough. hashcat (mode 16500) or jwt_tool find secrets taken from tutorials or sample files within seconds. An HMAC secret must be random and at least 256 bits long for HS256 (RFC 7518, section 3.2).

Injection through kid, jku and x5u

The kid parameter is often used to look up a key in a file or a database. Without validation, it becomes a path traversal vector (../../dev/null to get an empty key) or an SQL injection point. The jku and x5u parameters point to a URL to fetch the key from: a server that follows them without an allow list downloads the attacker’s key.

No expiry

Without an exp claim, a token stolen from a log, a browser history or a Git repository stays valid forever. Since a JWT is hard to revoke, a short expiry is the main protection.

Good practice

• Pin the list of accepted algorithms on the server and reject none.
• Always check exp, nbf, iss and aud.
• Use a random HMAC secret of at least 256 bits, or an asymmetric key pair when several services verify tokens.
• Put only identifiers and roles in the payload, never a secret.
• Validate kid against a closed list and ignore jku, x5u and jwk if you do not need them.