JWT Inspect

API reference

Decode a JSON Web Token and lint the claims. The signature is never checked, and a signing secret sent with the request is refused.

Paste the compact token. Nothing is stored. Ctrl or Cmd + Enter inspects.

A compact JWT has three segments separated by dots.

Findings

Nothing inspected yet. Load the expired token to see an exp claim reported as “Expired claim flagged.”

Use the API

The canonical door is jwt-inspect.over9000.cc. Responses are JSON. verified is always false.

POST /api/inspect
JSON body {"token":"..."}. jwt and access_token are aliases. This is the call to use: the token stays out of the URL.
POST form or text
application/x-www-form-urlencoded with a token field, or text/plain whose body is the token itself.
GET /api/inspect?token=
Same report. Query strings are often logged, so prefer POST.
GET /api/health
Liveness. {"ok":true,"service":"jwt-inspect","verified":false}.
GET /api/openapi.json
OpenAPI 3.1 document.
curl -sS https://jwt-inspect.over9000.cc/api/inspect \
  -H 'content-type: application/json' \
  --data '{"token":"'"$TOKEN"'"}'

What the linter checks

  • Three base64url segments and JSON objects for the header and payload. Five segments are reported as a JWE and are not decrypted.
  • alg: none, including disguised spellings, and an empty signature on an algorithm that should sign.
  • An exp in the past is an error whose message starts “Expired claim flagged.” A missing exp, an exp inside five minutes, and an nbf in the future are called out too.
  • iat after exp, nbf after exp, and lifetimes longer than a year.
  • crit extensions, remote jku or x5u, and an embedded jwk or x5c. None of those are fetched or trusted.
  • Duplicate JSON keys, and claim names that look like passwords, keys, or tokens.

What it refuses

  • It does not verify HS, RS, PS, ES, or EdDSA signatures, and it does not decrypt a JWE.
  • A JSON or form field named secret, key, private_key, jwt_secret, api_key, or the same idea with different punctuation, is rejected. The value is not echoed.
  • Tokens longer than 20,000 characters, and bodies larger than 32,000 bytes, are refused.
  • Nothing is stored. No cookies are set.

lint_ok is true only when there are no error findings. A clean lint is not a verified token.