JWT VERIFICATION MISUSE CHECK · RUNS IN YOUR BROWSER

Is your code verifying JWTs, or just reading them?

A token whose signature is never checked is a note anyone can write. jwt.decode where jwt.verify was needed, verify_signature: False, the none algorithm, no pinned algorithms, ignored expiry and a hard-coded 'secret' all turn authentication into a formality. Paste your source below and this page lists each one with its file and line, the risk, and the exact fix.

Nothing is uploaded. The code you paste is read in this browser and never leaves your device, and this tool makes no network calls of its own. It is a heuristic line scan, not a security audit.

1. Paste one or more source files

Copy the code of each file that signs or verifies tokens (JavaScript, TypeScript, Python, Go or Java). Give each block its real file name so the language is detected, for example auth.js or handlers.py.

Paste at least one source file above and click Check.

Prefer a CLI, or want this in your own CI?

Same logic, zero dependencies, one file:

python3 check.py                  # scan source files under the current directory
python3 check.py src/ app.py      # scan specific directories or files
python3 check.py --format json    # machine-readable
python3 check.py --fail-on-risk   # exit 2 if any finding exists

Get check.py from the repo — stdlib only, nothing to install, no network calls. It skips node_modules, vendor, .git and build folders.

Common questions

What is JWT verification misuse?

It is code that accepts a JSON Web Token without actually proving the issuer signed it: decoding without verifying, switching signature checks off, accepting the none algorithm, letting the token pick its own algorithm, ignoring expiry, or verifying with a guessable or caller-supplied key. Each one lets an attacker forge a token your server will trust.

Is jwt.decode the same as jwt.verify?

No. In jsonwebtoken, jwt.decode only base64-decodes the token and checks no signature, so anything an attacker types into the payload is returned as if it were real. jwt.verify checks the signature. Use decode only for claims you never trust, such as showing a name in a UI.

Why must the algorithms option be pinned?

If you do not pin it, the library may let the token's own alg header choose how it is checked. That is the root of the none-algorithm and RS256-to-HS256 key-confusion attacks. Pin the single algorithm you issue with, for example algorithms: ['RS256'].

Does this tool send my source code anywhere?

No. It makes no network calls at all. The code you paste is scanned in this page and never leaves your device.

Does a clean scan mean my JWT handling is safe?

No. This is a heuristic line scan, not a security audit. It misses misuse split across functions or built dynamically, it flags some safe code, and it cannot judge your key management, token lifetime or revocation. Have a qualified person review authentication code that protects anything valuable.

More: what is JWT verification misuse, and how do you fix each kind?