# JWT Decoder & Security Auditor Decode JWT header and payload, verify HS256 or RS256 signatures, and flag algorithm, expiry, and sensitive-claim security risks > Canonical page: https://elysiatools.com/en/tools/jwt-decoder-security-auditor - **Category:** Security - **Keywords:** jwt, decoder, security, token, hs256, rs256, auth, claims ## Overview Paste a JWT and optionally provide an HMAC secret or RSA public key to verify the signature, inspect claims, and review practical token security findings plus claim simulation scenarios. ## Inputs - **JWT Token** (textarea): eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... - **HMAC Secret (Optional)** (text): my-shared-secret - **RSA Public Key PEM (Optional)** (textarea): -----BEGIN PUBLIC KEY----- ## When to use - Debugging authentication failures or unexpected authorization behaviors in web applications. - Auditing third-party or internally generated JWTs for security misconfigurations like missing expiration dates. - Verifying token signatures during API development using HMAC secrets or RSA public keys. ## How it works - Paste your encoded JWT into the primary input field. - Optionally, provide an HMAC secret or RSA public key to enable cryptographic signature verification. - The tool decodes the token's header and payload into readable JSON formats. - It automatically scans the claims to flag security risks, such as expired tokens, weak algorithms, or exposed sensitive data. ## Use cases - Full-stack developers troubleshooting login flows and inspecting user roles embedded in token payloads. - Security engineers performing penetration testing to check if an application accepts tokens with the 'none' algorithm. - API integrators validating that identity providers are issuing tokens with correct issuer (iss) and audience (aud) claims. ## Frequently asked questions ### Does this tool store my JWTs or secret keys? No, all decoding and auditing processes happen locally in your browser. Your tokens and keys are never sent to a server. ### Which signature algorithms are supported for verification? The tool currently supports verifying signatures for HS256 (using an HMAC secret) and RS256 (using an RSA public key). ### Can I decode a JWT without providing a secret key? Yes. You can decode the header and payload without a key, but signature verification requires the corresponding secret or public key. ### What kind of security risks does the auditor flag? It checks for missing or past expiration dates (exp), weak or 'none' algorithms in the header, and potentially sensitive information stored in plaintext claims. ### Why is my RS256 signature verification failing? Ensure you are pasting the complete RSA public key in PEM format, including the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- tags. ## Related tools - [X.509 Certificate Decoder](https://elysiatools.com/en/tools/certificate-decoder): Parse an X.509 SSL/TLS certificate (paste PEM or upload .pem/.crt) and inspect subject, issuer, validity period with expiry status, public key, signature algorithm, serial, SANs, key usage and fingerprint. Like openssl x509 -text, visualised. Runs locally. - [JWT Inspector & Verifier](https://elysiatools.com/en/tools/jwt-inspector-verifier): Decode a JWT (header + payload) with syntax highlighting, diagnose standard claims, and verify the signature with HS*/RS*/PS*/ES*/EdDSA keys — plus a tampered-token forgery demo - [JWT Decoder](https://elysiatools.com/en/tools/jwt-decoder): Decode JWT tokens - [Distributed Trace Decoder & Waterfall Visualizer](https://elysiatools.com/en/tools/distributed-trace-decoder-waterfall-visualizer): Decode Jaeger, Zipkin, or OpenTelemetry trace JSON and render span timing, dependencies, and error hotspots as an interactive waterfall report - [Leetspeak Decoder & Detector](https://elysiatools.com/en/tools/leetspeak-decoder-detector): Decode leetspeak (1337) to plain text and score how plausibly leet an input is — for password-policy bypass screening, profanity-filter evasion, and log-noise filtering. - [Security Headers Checker](https://elysiatools.com/en/tools/security-headers-checker): Audit HTTP response headers for security compliance — parses the raw headers you paste (no network) and grades them against the OWASP secure-header set with value-level checks: HSTS max-age, CSP unsafe-inline/eval, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and more. Outputs a letter grade (A+ to F) plus per-header findings with copy-ready fix recommendations. - [Snowflake / Discord ID Bit Decoder](https://elysiatools.com/en/tools/snowflake-discord-id-bit-decoder): Decode 64-bit Snowflake-style IDs for Discord, Twitter, Mastodon, Sonyflake, Instagram, or a custom bit profile. Extract timestamp, worker/process/machine, sequence fields, align platform epochs, and infer a Discord shard when a shard count is supplied. - [ULID / NanoID / KSUID / Snowflake ID Decoder](https://elysiatools.com/en/tools/ulid-nanoid-ksuid-snowflake-id-decoder): Decode lexically sortable IDs losslessly with BigInt: ULID (Crockford base32), KSUID (base62), NanoID, MongoDB ObjectId, and Discord/Twitter/Sonyflake Snowflakes — with ISO timestamps, raw hex, bit-level field breakdowns and birthday-bound collision probabilities. ## Samples - [JWT Samples](https://elysiatools.com/en/samples/jwt-samples): Comprehensive JWT examples from basic token structure to advanced security implementations - [Network Security and SSL/TLS Configuration](https://elysiatools.com/en/samples/network-security): Comprehensive network security examples including SSL/TLS configuration, firewall rules, VPN setup, and network scanning protection - [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion - [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion ## Related content - [Credential and JWT Security Workflow](https://elysiatools.com/en/hubs/auth-token-security): Generate or validate password credentials and inspect JWT security signals without treating key pairs as passwords. - [JWT Construction and Security Review](https://elysiatools.com/en/hubs/jwt-construction-and-security-review): Build a controlled JWT fixture or inspect an authorized sample, then review claims, algorithms, expiry, sensitive fields, and signature evidence without confusing decoding with verification. - [PII Detection and Log Redaction Review](https://elysiatools.com/en/hubs/pii-log-redaction): Find likely personal data in logs, text, and PDFs, redact review copies, validate identifier patterns, and require human approval before sharing. - [Authorized JWT, OTP, TOTP, and Session Test Workflow](https://elysiatools.com/en/hubs/token-session-and-2fa-workflows): Build sanitized auth fixtures, separate token generation from decoding and verification, test OTP/TOTP timing, and audit JWT and session evidence without exposing real secrets.