What this tool does
Most signed JWTs are encoded, not encrypted. Anyone who receives the token can usually decode the header and payload without the signing key.
This checker never verifies the signature and never confirms whether a token is valid, expired, revoked, or safe. Its purpose is limited to privacy review before sharing.
Recommended workflow
- Prefer a test tokenUse a non-production token whenever possible.
- Decode the payloadReview identity, tenant, organization, permission, audience, and issuer claims.
- Create a synthetic exampleReplace real values while keeping the claim names needed for debugging.
- Revoke exposed live tokensTreat a shared access-bearing token as compromised until proven otherwise.
What it checks
The current tool version is designed to handle the following areas:
- readable JWT header
- readable JWT payload
- claim names that look identity- or permission-related
Example
Before
A live JWT copied into a public issue because the payload was assumed to be encrypted.Safer output
A decoded, reviewed payload example with real claim values replaced and the live token revoked if exposed.Safety checks before sharing
- Do not assume signing hides the payload
- Check custom claims as well as standard claims
- Remove the complete token from screenshots and logs
- Use server-side validation for trust decisions
Representative test coverage
This page is checked with representative examples, not every possible format or file produced by every application.
- three-part signed JWT strings
- base64url header and payload sections
- common identity claims
Known limitations
Automated processing can miss unusual formats, indirect identifiers, hidden data, unsupported structures, and information that requires human judgment. This tool may miss:
- encrypted JWE content
- meaning hidden in custom claims
- signature problems
- server-side token state
- access granted by the live token
Do not describe the result as fully anonymous, legally compliant, secure, or impossible to re-identify. Review the exact final artifact before sharing it.
Frequently asked questions
Does JWT Privacy Checker upload my input?
The normal tool workflow runs in your browser. The page code is downloaded from the website, but the content you paste or select is processed locally and is not sent to a Privacy Toolbox processing API.
Can this guarantee complete anonymization?
No. Automated checks can miss context clues, unusual identifiers, text inside unsupported files, and details that only a person would recognize. Always review the result before sharing.
Should I use this for regulated or highly sensitive data?
Only when your organization permits it. For medical, legal, financial, employment, or customer data, follow your approved security and compliance process rather than relying on a free pattern-based tool alone.