JWT Sensitive Claim Auditor
Local ProcessingInspect JSON Web Token (JWT) payloads locally and flag potentially exposed sensitive claims like passwords, secrets, or PII.
How It Works & Processing Standards
Inspect JSON Web Token (JWT) payloads locally and flag potentially exposed sensitive claims like passwords, secrets, or PII.
Tool processing runs in your browser. If you create a calculator or conversion share link, its values are included in the URL. See the privacy policy for account, analytics and advertising data.
Current Limits
- Maximum input length: 2,000,000 characters
A JWT payload is signed but not encrypted, so anyone can read it. Paste a token to see the claim count and which claim names need attention.
Only field names are checked. An ordinary-looking name can still hold sensitive data, so decode and look.
What You Can Do
- Find sensitive claims
- Looks for common sensitive field names such as email and password.
- Claim count
- Shows how many claims the payload has.
How to Use JWT Sensitive Claim Auditor
- 1Paste the tokenPaste the JWT to inspect.
- 2Read the resultSee the claims flagged for attention.
Examples
Common Use Cases
- Checking that a login API does not leak personal data in its tokens
- Ticking "no sensitive data in tokens" on a security checklist
Frequently Asked Questions (FAQ)
Is a signed token not safe?
A signature only proves the content was not changed. The content is Base64URL that anyone can read, so never put passwords or ID numbers in it.