JWT Header Inspector
Audit JSON Web Token JOSE headers for critical vulnerabilities per RFC 8725 Best Current Practices. Detect 'alg: none' exploits, Key ID path traversal, embedded JWK forgery, and algorithm confusion.
JOSE Header Security Scanner
Security Vulnerability Audit
The token specifies a recognized, cryptographically robust algorithm: HS256.
Explicit type header helps backend services differentiate access tokens, ID tokens, and logout tokens.
Detected Parameters Dictionary
| Header Field | Parsed Value | Classification | Security Function & Risk Impact |
|---|---|---|---|
| alg | "HS256" | SECURITY CRITICAL | Algorithm used to secure the JWS or JWE token. Critical: Determines the cryptographic method and signature validation logic. |
| typ | "JWT" | Standard JOSE | Media type of the complete token (typically "JWT" or "at+jwt"). Important: Prevents cross-type confusion and token substitution attacks (RFC 8725 §3.11). |
In-Browser JOSE Header Security and RFC 8725 Compliance Auditing
The JWT Header Inspector audits JSON Web Token JOSE headers for configuration risks and implementation vulnerabilities directly within your web browser. By evaluating header attributes against established cryptographic standards in local memory, developers and security engineers can verify header integrity without exposing token structures to third-party endpoints.
The inspector checks token parameters against RFC 8725 (JSON Web Token Best Current Practices) and RFC 7515 (JSON Web Signature). It scans for critical attack vectors including the 'alg: none' signature bypass vulnerability (CVE-2015-9235), path traversal or SQL injection patterns within Key IDs (kid), self-signed embedded public keys (jwk), and unvalidated remote certificate endpoints (x5u).
This utility provides an automated security posture rating from 0 to 100, categorized vulnerability findings with severity badges and RFC citations, actionable remediation recommendations, and an interactive JOSE parameter dictionary mapping every header field to its functional security impact.
Core Tool Capabilities
- RFC 8725 Compliance Evaluation: Evaluates token header attributes against authoritative IETF Best Current Practices to ensure authentication systems follow modern defensive standards.
- Heuristic Vulnerability Detection: Scans for known attack vectors including unsigned 'alg: none' tokens, directory traversal patterns in Key IDs, embedded public keys, and deprecated SHA-1 digests.
- Automated Posture Scoring: Calculates an objective security rating from 0 to 100 based on the presence of critical, high, and medium severity findings with clear risk classification.
- JOSE Parameter Dictionary: Deconstructs standard and custom header parameters into a structured reference table detailing their cryptographic function and operational security impact.
- Client-Side In-Memory Analysis: Performs all JSON parsing, pattern matching, and rule evaluation locally in browser RAM with zero external server dependencies.
Local Browser Privacy
Your files are processed locally on your device. Files are not uploaded, transmitted, or stored on remote servers.
Once the page has loaded, you can disconnect your network connection and continue using this tool offline.
Target Use Cases
- • Security Code Reviews and Hardening
- • Authentication API Penetration Testing
- • Identity Provider Header Verification
- • JWT Library and Middleware Auditing
Technical Specifications & Platform Limits
Official IETF security and signature specifications.
Heuristic checks targeting common implementation flaws.
Parses complete tokens or isolated header objects directly.
Zero external network requests or remote API logging.
Step-by-Step Workflow
Provide Token or Header
Paste a complete JSON Web Token string, a Base64URL header segment, or a raw JSON object into the input workspace.
Review Security Posture Score
Check the overall numerical rating (0 to 100) and risk level tier to gauge baseline header security.
Inspect Categorized Findings
Review specific vulnerability warnings, RFC references, and concrete remediation instructions to resolve flagged issues.
Consult Parameter Dictionary
Examine the detected parameter breakdown to verify that standard and custom header fields are properly structured.
Practical Real-World Use Cases
Security Code Reviews and Hardening
Security engineers auditing authentication services and microservice gateways to verify that issued tokens enforce strict algorithm whitelisting.
Authentication API Penetration Testing
QA engineers and penetration testers evaluating backend token parsers against malicious inputs like 'alg: none' and manipulated Key IDs.
Identity Provider Header Verification
DevOps and cloud architects inspecting OAuth 2.0 and OIDC token headers during tenant migration and key rotation events.
JWT Library and Middleware Auditing
Software developers checking whether their backend JWT validation libraries enforce type checks and reject insecure header configurations.
Frequently Asked Questions
- What is the 'alg: none' vulnerability?
- The 'alg: none' vulnerability (CVE-2015-9235) occurs when a backend verification service accepts unsigned tokens because the header explicitly requests no cryptographic algorithm. Attackers can exploit this by modifying claims and omitting the signature segment entirely.
- Why is an embedded 'jwk' header potentially risky?
- If a server verifies token signatures using the public key supplied directly in the token's 'jwk' header without validating it against a trusted key store, an attacker can generate their own key pair, embed the public key, and forge valid tokens.
- What security role does the 'kid' parameter serve?
- The Key ID (kid) parameter acts as a hint indicating which cryptographic key from a server's key set was used to sign the token. It must be sanitized to prevent directory traversal or SQL injection attacks during key lookup.
- Why does RFC 8725 recommend explicit 'typ' declarations?
- Explicitly declaring 'typ': 'JWT' (or 'at+jwt' for access tokens) helps prevent cross-type confusion attacks where an access token might otherwise be accepted in a context intended only for an ID token or logout token.
- Does this tool perform remote network requests to resolve certificate URLs?
- No. The inspector evaluates headers purely through static client-side analysis. It does not initiate remote network requests to resolve URLs specified in 'x5u' or 'jku' parameters.
Share this tool
Help others discover this utility. No login or registration required.
Master this tool with Guides & Articles
Learn the workflows, common mistakes, and advanced techniques behind JWT Header Inspector - Audit JOSE Headers & RFC 8725 Compliance with our deep-dive educational content.