JWT Decoder & Security Analyzer 🔐

Decode, verify, and security-audit JSON Web Tokens (JWTs) in seconds — decode header and payload, verify HMAC/RSA/ECDSA/EdDSA cryptographic signatures, and automatically detect critical vulnerabilities including algorithm none bypass, asymmetric key confusion, weak secrets, expired tokens, and missing standard claims — all in a single run.

---

What does it do?

JWT Decoder & Security Analyzer is a comprehensive JSON Web Token inspection and security assessment tool built for DevSecOps engineers, penetration testers, API developers, and compliance teams. It goes far beyond basic base64url decoding by cryptographically verifying token signatures across 12+ algorithms — including HMAC (HS256/HS384/HS512), RSA (RS256/RS384/RS512), ECDSA (ES256/ES384/ES512), and EdDSA (Ed25519/Ed448) — and running an automated multi-check vulnerability scan that catches misconfigurations before attackers can exploit them.

Unlike web-based JWT debuggers that expose sensitive tokens to third-party servers and offer no batch capabilities, this actor runs entirely server-side within your Apify pipeline, handles batch processing of up to 100 tokens in a single run, and produces structured, machine-readable security reports suitable for CI/CD gates, compliance documentation (SOC 2, ISO 27001), and penetration testing workflows. Every finding includes a CVSS-style severity weight, a human-readable description, and an actionable remediation recommendation — so you can fix issues immediately rather than hunting down documentation.

The actor operates in two modes: decode mode (fast header-and-payload inspection with no security analysis) and full mode (comprehensive decode + vulnerability scan with signature verification). When processing multiple tokens with generateReport enabled, it produces a consolidated audit report that includes risk distribution summaries, algorithm usage discovery, valid-versus-invalid token counts, and per-token breakdowns — giving you a complete security posture snapshot of your entire JWT ecosystem.

---

Who is it for?

Persona	What they use it for
DevSecOps Engineers	Integrate automated JWT validation into CI/CD pipelines; block deployments containing tokens with critical vulnerabilities
Penetration Testers	Systematically test authentication endpoints for algorithm confusion, alg=none bypass, weak HMAC secrets, and signature verification flaws
API Developers	Inspect token contents and verify signatures during local development without sending sensitive credentials to third-party websites
Security Auditors	Generate audit-ready token security reports with CVSS-weighted findings for SOC 2, ISO 27001, PCI-DSS, and other compliance frameworks
Platform Engineering Teams	Validate JWTs across microservice boundaries during key rotation events, provider migrations, or architecture changes
Identity Provider Administrators	Batch-verify thousands of tokens during OIDC provider migrations, secret rotation events, or post-incident security reviews

---

Why use this?

• 🔴 Catch critical vulnerabilities before attackers do — Automatically detects alg=none signature bypass (CVSS 9.1), asymmetric key confusion attacks (CVSS 8.5), and weak HMAC secrets (CVSS 7.5) that are among the most commonly exploited JWT misconfigurations in production.

• 🔐 Verify cryptographic signatures without third-party exposure — Contrary to pasting tokens into jwt.io or similar web tools, this actor processes all tokens server-side within your Apify pipeline. No sensitive token data ever leaves your trusted execution environment.

• ⚡ Batch-process up to 100 tokens per run — Analyze an entire batch of tokens from a single input array, complete with a consolidated audit report showing risk distribution, algorithms found, and per-token breakdowns — perfect for key rotation events and mass migrations.

• 📊 Get CVSS-weighted, actionable findings — Every security finding includes a CVSS-style severity score, a plain-English description of the issue, and a concrete remediation recommendation. No vague alerts — you know exactly what to fix and how.

• 🧩 Support for every major signing algorithm — HMAC (HS256/HS384/HS512), RSA (RS256/RS384/RS512), ECDSA (ES256/ES384/ES512), and EdDSA (Ed25519/Ed448) are all fully supported for both decoding and cryptographic signature verification.

• 📋 Generate compliance-ready audit reports — Enable generateReport in batch mode to produce structured audit reports with risk distribution summaries, algorithm usage discovery, and per-token security breakdowns — ready for SOC 2, ISO 27001, and PCI-DSS compliance documentation.

• 🛡️ Detect missing security claims automatically — The scanner flags tokens missing the jti (JWT ID) claim that helps prevent replay attacks and the iss (issuer) claim recommended for multi-service environments, ensuring your tokens follow OAuth 2.0 and OpenID Connect best practices.

• 📈 Risk scoring with five severity levels — Each token receives a composite risk score (SAFE, LOW, MEDIUM, HIGH, CRITICAL) and a numeric risk level (0–10) so you can prioritize remediation efforts across your entire token inventory.

---

Features

Token Decoding

• Decode JWT header and payload from base64url encoding with structured JSON output
• Handle all standard JWT compact serialization formats (3-part encoding)
• Graceful error handling for malformed tokens — invalid base64, non-JSON payloads, unexpected part counts, and truncated inputs
• Automatic detection and reporting of unsecured JWTs (2-part tokens with no signature)
• Signature extraction as hexadecimal representation with byte-length reporting

Cryptographic Signature Verification

• HMAC: HS256 (SHA-256), HS384 (SHA-384), HS512 (SHA-512) — constant-time verification against a provided secret using hmac.compare_digest
• RSA: RS256 (SHA-256), RS384 (SHA-384), RS512 (SHA-512) — PKCS1v15 signature verification against PEM-encoded RSA public keys via the cryptography library
• ECDSA: ES256 (SHA-256, P-256), ES384 (SHA-384, P-384), ES512 (SHA-512, P-521) — ECDSA signature verification against PEM-encoded EC public keys
• EdDSA: Ed25519 and Ed448 — full EdDSA verification against PEM-encoded Ed25519/Ed448 public keys
• Support for both symmetric (HMAC secret) and asymmetric (PEM public key) verification workflows
• Clear PASS/FAIL findings for every verification attempt with descriptive messages

Security Vulnerability Scanner

Finding	Severity	CVSS	Description
alg=none Signature Bypass	🔴 CRITICAL	9.1	Detects unsigned tokens using the none algorithm — a critical misconfiguration allowing arbitrary token forgery
Asymmetric Key Confusion	🔴 CRITICAL	8.5	Detects HMAC algorithm tokens being verified against PEM-formatted RSA/EC keys, a vector for key confusion attacks
Weak HMAC Secret	🟠 HIGH	7.5	Identifies HMAC secrets shorter than 16 characters or matching common/weak values (secret, key, password, 123456, admin, test)
Invalid Signature — Tampered Token	🟠 HIGH	8.0	Token signature verification failed — the token has been tampered with or the wrong key/secret was provided
Empty or Malformed Signature	🟠 HIGH	7.0	Token claims a non-none algorithm but has an empty or malformed signature block
Signature Verification Error	🟡 WARNING	0.0	Cryptographic library error during signature verification (key format mismatch, unsupported curve, etc.)
Token Expired	ℹ️ INFO	0.0	Token's exp claim is in the past; includes human-readable expiry time and minutes since expiration
Token Nearing Expiry	ℹ️ INFO	0.0	Token will expire within 60 minutes; includes remaining time and exact expiry timestamp
Token Not Yet Valid (nbf)	ℹ️ INFO	0.0	Token's nbf (not-before) claim is in the future; token is not yet usable
Missing jti (JWT ID)	ℹ️ INFO	1.0	Token lacks a unique identifier — adding jti helps prevent token replay attacks
Missing iss (Issuer)	ℹ️ INFO	0.0	Token does not specify an issuer — recommended for multi-service environments

Risk Scoring System

• Composite numeric risk level from 0 (safe) to 10 (maximum risk)
• Five severity categories: SAFE → LOW → MEDIUM → HIGH → CRITICAL
• CVSS-inspired weighting: CRITICAL findings add 4 points, HIGH findings add 3 points
• Risk score automatically computed from finding severity and count
• Per-token risk assessment available in both single and batch modes

Batch Processing

• Process up to 100 tokens in a single run via the tokens input array
• Per-token indexing with sequential processing
• Automatic deduplication: tokens from both token and tokens fields are combined
• Maximum input validation with clear error messages

Audit Report Generation

• Consolidated report with timestamp, total token count, and full results array
• Risk distribution summary: critical, high, medium, low, and safe token counts
• Algorithm usage discovery — lists all unique algorithms found across the batch
• Valid vs. invalid token counts for format integrity assessment
• Each token's full decode result and security analysis preserved in the report

Mode Selection

• decode mode: Fast decoding only — header and payload inspection without security analysis or signature verification
• full mode (default): Comprehensive analysis — decode + full vulnerability scan + signature verification

Token Integrity Checks

• Validates JWT compact serialization format (expects exactly 3 dot-separated segments)
• Detects unsecured tokens (2-part format without signature)
• Reports invalid base64url encoding with specific error messages
• Handles non-JSON payloads gracefully — returns raw string representation
• Reports signature byte length for cryptographic strength assessment

---

Input Parameters

Field	Type	Required	Default	Description
token	string	No	—	A single JWT token to decode and analyze. Required if tokens is empty.
tokens	array	No	[]	Array of JWT tokens for batch processing (maximum 100). When provided with generateReport, produces a consolidated audit report.
mode	select	No	full	Analysis mode: decode (decode header and payload only) or full (decode + comprehensive security vulnerability scan with signature verification).
secretOrKey	string	No	—	HMAC secret for HS256/HS384/HS512, or PEM-encoded RSA/EC/EdDSA public key for asymmetric algorithm verification. Omit to skip signature verification.
generateReport	boolean	No	false	When true and processing multiple tokens, produces a consolidated audit report with risk distribution summary, algorithm usage discovery, and per-token breakdowns.

At least one token must be provided via token (single mode) or tokens (batch mode). If both are supplied, they are combined and processed together.

---

Example Input

Single Token Mode

{
  "mode": "full",
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "secretOrKey": "your-256-bit-secret-key-here-minimum-length",
  "generateReport": false
}

Batch Mode (with Audit Report)

{
  "mode": "full",
  "tokens": [
    "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
    "eyJhbGciOiJub25lIn0.eyJzdWIiOiJhZG1pbiIsInJvbGUiOiJhZG1pbiJ9.",
    "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ0ZXN0IiwiaWF0IjoxNTE2MjM5MDIyfQ.MEQCICpXHKPLjpPWRxQAHqDbP-4vEJNJX_d4h1lVLbmM1P4oAiA1vKNMVpB_ESDs_VnHESjAjeXHic_27I5htVyt0S22BA"
  ],
  "secretOrKey": "your-256-bit-secret-key-here",
  "generateReport": true
}

---

Output Structure

Single Token Output (field map)

Field	Type	Description
decoded.token	string	Truncated JWT token (first 80 characters)
decoded.validFormat	boolean	Whether the token has valid JWT compact serialization format
decoded.parts	integer	Number of dot-separated parts (expected: 3)
decoded.header	object	Decoded JWT header containing alg, typ, kid, etc.
decoded.payload	object	Decoded JWT payload with all claims (sub, iss, exp, iat, etc.)
decoded.signature	string	Signature as hexadecimal string
decoded.signatureBytes	integer	Length of the signature in bytes
decoded.error	string	Error message if token format is invalid
security.riskScore	string	Overall risk category: SAFE, LOW, MEDIUM, HIGH, or CRITICAL
security.riskLevel	integer	Numeric risk level from 0 (safe) to 10 (critical)
security.signatureValid	boolean or null	Signature verification result (null when no key provided)
security.findings[]	array	Array of security findings with type, title, description, CVSS score, and remediation

Batch Audit Report Output (field map)

Field	Type	Description
auditTimestamp	string	ISO 8601 timestamp of when the audit was generated
totalTokens	integer	Total number of tokens processed
summary.validTokens	integer	Number of tokens with valid JWT format
summary.invalidTokens	integer	Number of malformed or invalid tokens
summary.riskDistribution.critical	integer	Count of tokens scored CRITICAL
summary.riskDistribution.high	integer	Count of tokens scored HIGH
summary.riskDistribution.medium	integer	Count of tokens scored MEDIUM
summary.riskDistribution.low	integer	Count of tokens scored LOW
summary.riskDistribution.safe	integer	Count of tokens scored SAFE
summary.algorithmsFound	array	List of unique algorithms detected across the batch
tokens[]	array	Array of per-token decode and security results (same structure as single mode)

---

Output Format

Single Token — Full Mode Response

{
  "decoded": {
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibm...",
    "validFormat": true,
    "parts": 3,
    "header": {
      "alg": "HS256",
      "typ": "JWT"
    },
    "payload": {
      "sub": "1234567890",
      "name": "John Doe",
      "iat": 1516239022,
      "exp": 1716239022
    },
    "signature": "7348f2c7044948f1828513d84f1f0a4c789f7f8e8e93ac4957f5d41b2cc30e5c",
    "signatureBytes": 32
  },
  "security": {
    "riskScore": "SAFE",
    "riskLevel": 1,
    "signatureValid": true,
    "findings": [
      {
        "type": "PASS",
        "title": "HMAC Signature Verified",
        "description": "Token signature verified successfully with provided secret.",
        "cvss": 0.0
      },
      {
        "type": "INFO",
        "title": "Missing jti (JWT ID)",
        "description": "The token does not contain a 'jti' claim. Adding a unique identifier helps prevent token replay attacks.",
        "cvss": 1.0,
        "remediation": "Include a 'jti' claim with a unique value (e.g., UUID)."
      }
    ]
  }
}

Batch Mode — Audit Report Response

{
  "auditTimestamp": "2026-07-23T11:30:00.123456+00:00",
  "totalTokens": 3,
  "summary": {
    "validTokens": 3,
    "invalidTokens": 0,
    "riskDistribution": {
      "critical": 1,
      "high": 0,
      "medium": 0,
      "low": 0,
      "safe": 2
    },
    "algorithmsFound": [
      "HS256",
      "none",
      "RS256"
    ]
  },
  "tokens": [
    {
      "index": 0,
      "decoded": {
        "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
        "validFormat": true,
        "parts": 3,
        "header": { "alg": "HS256", "typ": "JWT" },
        "payload": { "sub": "1234567890", "name": "John Doe", "iat": 1516239022 },
        "signature": "7348f2c7044948f1828513d84f1f0a4c789f7f8e8e93ac4957f5d41b2cc30e5c",
        "signatureBytes": 32
      },
      "security": {
        "riskScore": "SAFE",
        "riskLevel": 1,
        "signatureValid": true,
        "findings": [
          { "type": "PASS", "title": "HMAC Signature Verified", "cvss": 0.0 }
        ]
      }
    },
    {
      "index": 1,
      "decoded": {
        "token": "eyJhbGciOiJub25lIn0...",
        "validFormat": true,
        "parts": 3,
        "header": { "alg": "none" },
        "payload": { "sub": "admin", "role": "admin" },
        "signature": "",
        "signatureBytes": 0
      },
      "security": {
        "riskScore": "CRITICAL",
        "riskLevel": 4,
        "signatureValid": null,
        "findings": [
          {
            "type": "CRITICAL",
            "title": "alg=none (Signature Bypass)",
            "description": "The token uses alg='none', meaning the server accepts unsigned tokens. This is a critical vulnerability — an attacker can forge arbitrary tokens.",
            "cvss": 9.1,
            "remediation": "Configure the server to reject 'none' algorithm. Use a strict allowlist."
          }
        ]
      }
    },
    {
      "index": 2,
      "decoded": {
        "token": "eyJhbGciOiJSUzI1NiJ9...",
        "validFormat": true,
        "parts": 3,
        "header": { "alg": "RS256" },
        "payload": { "sub": "test", "iat": 1516239022 },
        "signature": "304402201ca71ca3e3a4f0f464714007a83db3fef0bc449357f77887594b6e60d4cf4e28...",
        "signatureBytes": 71
      },
      "security": {
        "riskScore": "SAFE",
        "riskLevel": 0,
        "signatureValid": true,
        "findings": [
          { "type": "PASS", "title": "RSA Signature Verified", "cvss": 0.0 }
        ]
      }
    }
  ]
}

---

Use Cases

• CI/CD Security Gate — Integrate JWT validation into your deployment pipeline to automatically block releases containing tokens with critical vulnerabilities (alg=none bypass, key confusion) or expired credentials. Each run produces structured output that can be parsed by your pipeline tooling to enforce security policies before code reaches production.

• Penetration Testing & Red Teaming — Systematically test authentication endpoints for the OWASP JWT Cheat Sheet's top misconfigurations: algorithm confusion, alg=none acceptance, weak HMAC secrets, and improper signature verification. Batch-scan hundreds of collected tokens and prioritize exploitation based on the CVSS-weighted findings.

• Authentication Provider Migration — When migrating from Auth0 to a custom OIDC provider, rotating HMAC secrets, or upgrading from RS256 to ES256, batch-verify existing tokens against the new infrastructure to ensure backward compatibility and zero downtime for your users. The audit report provides a complete inventory of algorithms and token validity.

• API Debugging & Development — Inspect token contents and verify signatures during local API development without pasting sensitive credentials into third-party websites. The actor runs entirely within your Apify account, keeping authentication secrets and token payloads private.

• DevSecOps Compliance & Auditing — Generate audit-ready token security reports for SOC 2, ISO 27001, PCI-DSS, and other compliance frameworks. The structured JSON output includes risk distribution summaries, CVSS-weighted findings with remediations, and per-token breakdowns — everything compliance auditors need to verify JWT security posture.

• Post-Incident Security Review — After a suspected token-related security incident (breach, misconfiguration, or abuse), batch-analyze all active tokens in your system to identify compromised credentials, expired tokens that should have been rotated, and algorithm misconfigurations that may have been exploited. The risk distribution summary gives you an immediate picture of blast radius.

• OIDC Provider Validation — When deploying OpenID Connect providers, validate that issued ID tokens and access tokens conform to expected algorithms, contain required claims (iss, exp, iat), and are properly signed. The scanner's missing-claims detection flags missing jti and iss claims — key OIDC Core specification requirements for token uniqueness and issuer identification.