Pentestas / help

JWT Analyzer

JWT Analyzer — Decode JWTs and flag common security weaknesses.
JWT Analyzer in the Pentestas Security tools UI.

Category: API / auth

Parses header/payload, checks algorithm, expiry claims, and classic footguns (alg=none, weak HMAC, algorithm confusion patterns) without needing the signing secret for decode.

Inputs

A JWT string (three base64url segments).

How to run it

  1. Open Security tools → JWT Analyzer.
  2. Paste token → analyze.
  3. Fix issues in your auth service before a full API scan.

Output

Decoded JSON + weakness list.

Notes

  • Signature verification requires the secret/JWKS — the tool still flags structural issues without it.
  • /scans/api-scan/
  • /tools/graphql-scanner/

← Back to Security tools overview