JWT Claims Analyzer

Runs in browser Security

Go beyond decoding: check for missing exp/iat/aud, overly long lifetimes, sensitive data in the payload, weak algorithms and other common mistakes according to RFC 7519 and OWASP guidance.

Privacy: This tool runs entirely in your browser. Your input never leaves your device.

How to use JWT Claims Analyzer

  1. Paste the token you want to audit.
  2. Read the score and the findings ordered by severity.
  3. Apply the recommendation next to each finding (for example shorten the lifetime or add aud).
  4. Re-issue the token and analyse it again until only informational items remain.

JWT Claims Analyzer features

  • Checks required and recommended claims: exp, iat, nbf, iss, aud, sub, jti
  • Flags long lifetimes, future iat, inverted validity windows and millisecond timestamps
  • Detects secrets and personal data placed in the payload
  • Warns about broad scopes, huge role lists and oversized payloads
  • Includes header risks (alg=none, jku/x5u, suspicious kid) in the same report
  • Security score with severity counts and a prioritised findings table

JWT Claims Analyzer example

Audit a token with a 73-year lifetime

Input:

{"iss":"https://auth.example.com","sub":"user_8f3a2c","aud":"api://orders","iat":1700000000,"exp":4102444800,"email":"layla@example.com","scope":"orders:read admin"}

Output:

Score 70/100
High — Very long lifetime (76y): access tokens should live minutes to hours.
Medium — Broad scopes: "orders:read admin" grants wide access.
Low — Personal data present: email.
Info — No jti: a unique id enables revocation.

Frequently asked questions about JWT Claims Analyzer

What does the security score mean?

It starts at 100 and subtracts points per finding (40 for critical, 20 for high, 10 for medium, 4 for low). It is a quick prioritisation aid, not a certification — read the individual findings.

Which checks are performed?

Presence and validity of exp, iat, nbf, iss, aud, sub and jti; token lifetime; expired or future-dated tokens; secrets or personal data in the payload; payload size; over-broad scopes; and header risks such as alg=none, jku/x5u URLs or suspicious kid values.

Why is a long lifetime flagged as a problem?

A leaked access token can be replayed until it expires. OWASP recommends short-lived access tokens (minutes to an hour) combined with refresh tokens, rather than tokens that live for days or months.

Why does it warn about my email claim?

JWT payloads are readable by everyone who handles the token. Personal data in tokens increases exposure and can fall under privacy regulation; keep payloads to identifiers and authorisation data.

Technical notes

The checks follow RFC 7519 (claim semantics), RFC 8725 (JWT best current practices) and the OWASP JSON Web Token cheat sheet. Findings are heuristics — a long lifetime may be acceptable for a refresh token, for instance — so read them in the context of how the token is used.