JWT Analyzer
Decodifica e analisi di sicurezza per token JSON Web Token (JWT). Risk scoring algoritmico su algoritmo, scadenza, alg=none, kid injection. 100% client-side: il token non lascia il browser.
Avviso: Questo tool NON verifica la firma crittografica. La firma autentica richiede la chiave segreta o il certificato pubblico del server emittente. Usare una libreria server-side (es. jsonwebtoken, java-jwt, PyJWT) per la verifica completa.
Token JWT
Il token deve avere 3 parti separate da punto. Solo base64url - nessun dato inviato a server.
Incolla un token JWT per avviare l'analisi, oppure usa Carica esempio.
Sicurezza JWT: risorse accademiche e standard
JWT (RFC 7519) e' uno standard ampiamente usato ma con pattern vulnerabili documentati. Questo tool segue le linee guida OWASP Top 10 e la ricerca in ambito autenticazione web.
Vulnerabilita' note
- alg=none - Consente token senza firma. Documentata da Auth0 (2015) e inclusa nell'OWASP Top 10 A02 Cryptographic Failures.
- HMAC vs RSA confusion - Una libreria che accetta HS256 al posto di RS256 puo' essere ingannata usando la chiave pubblica RSA come segreto HMAC.
- kid injection - Il campo
kid(Key ID) se non sanificato puo' essere usato per path traversal o SQL injection nella selezione della chiave. - Nessun claim exp - Token senza scadenza non possono essere revocati senza blacklist esplicita.
Percorsi universitari - Sicurezza Informatica
- Sapienza - CyberChallenge.IT 2025 - Primo classificato nazionale 2025. Percorso sicurezza informatica top in Italia.
- UniBa - Sede del CINI Cybersecurity National Lab (laboratorio nazionale CINI dedicato alla ricerca in sicurezza informatica, reti e crittografia applicata). Secondo classificato CyberChallenge.IT 2025.
Approfondisci con la serie UniAppunti / Sicurezza Informatica - autenticazione, crittografia, PKI, OAuth 2.0 e JWT in profondita'.
Come utilizzare JWT Analyzer
Attach your JWT token
Attach the token to the input field, or click "Load example" to see a pre-decoded token with header, payload and signature.
Read decoded headers and payloads
The tool automatically decodes base64url sections from the header and payload and shows them in JSON format, without ever sending the token to a server.
Check your risk score
Panel of findings signals critical/attention/OK issues: weak algorithm or alg=none, expired token or no claim expiration, suspicious patterns in the kid field.
Check time limits
Sections exp, iat and nbf are converted to ISO date and relative time (e.g. "expires in 2 hours"), for an at-a-glance understanding of the token's validity period.
Suggerimenti
- Never attach real production JWT tokens to third-party online tools, even if they claim to be client-side. Preferably use test or revocable tokens after analysis.
- If the tool signals "no exp claim", always add an explicit expiration date to your tokens: a token without an expiration date cannot be invalidated unless it's blacklisted on the server.
Domande frequenti
Does the tool verify the cryptographic signature of the token?
No. The tool decodes headers and payload (which are only base64url encoded, not encrypted) but does not verify the signature as it would require either the server's private or public key. The analysis focuses on structural risk scoring: algorithm, expiration date, suspicious patterns.
Why is "alg=none" considered a critical risk?
Be concise — keep similar length. This server accepts tokens without verifying any signature: anyone can create a token with any payload, including impersonating another user or assigning privileged roles. No production server should accept this algorithm.
Why is HS256 marked as "attention" and not "critical"?
HS256 is a symmetric HMAC algorithm: the same key signs and verifies tokens. It's not a vulnerability in itself, but if the shared key leaks (e.g., hardcoded in code or publicly exposed), all signed tokens with that key are compromised. Asymmetric algorithms like RS256 or ES256 are preferred because the private key remains only on the server.
What does the warning on "kid injection" mean?
Field ID (Key ID) in the header identifies which key to use for signature verification. If the server uses it to construct a file path or query without sanitizing it, an evil value (path traversal sequences, SQL-like apices, template injection patterns) can cause path traversal or injection. The tool flags suspicious patterns in the kid, but actual vulnerability depends on how the server handles it.
Are my token data saved or sent somewhere?
No. The entire analysis (base64url decoding, risk scoring, schedule calculation) happens on the client side in the browser. The token never leaves your device and is not stored in localStorage or sent to any server, including this site's server.