JWTInspector is a small, professional Python security tool for analyzing JSON Web Tokens and identifying risky token configurations.
- JWT header and payload decoding
- Algorithm posture analysis with a configurable allowlist
- Missing and expired claim detection
- Token lifetime analysis
- Issuer, audience, subject, issued-at, and not-before claim checks
- Sensitive-data claim detection
- JKU and embedded JWK warnings
- Suspicious
kiddetection - Human-readable terminal output
- JSON output for automation and CI pipelines
- Python package and CLI entry point
python -m pip install -e .jwtinspector --token 'HEADER.PAYLOAD.SIGNATURE'jwtinspector --token 'HEADER.PAYLOAD.SIGNATURE' --jsonjwtinspector --file token.txtJWTInspector
================================================
Algorithm : RS256
Type : JWT
Issuer : https://issuer.example
Audience : api.example
Subject : user-123
[MEDIUM] Long token lifetime
The token lifetime is approximately 2.0 days.
Recommendation: Prefer short-lived access tokens and rotate refresh tokens.
The Python API accepts an optional algorithm allowlist through analyze_jwt(token, allowed_algorithms=...). When omitted, a conservative built-in set is used. Passing an explicit empty set means that no signing algorithms are accepted by policy.
The CLI keeps the executable name jwtinspector; the importable Python package is named jwt_audit.
JWTInspector performs static inspection of a JWT. It does not attempt to forge tokens, crack signing secrets, bypass authentication, or exploit a remote target.
Use it with tokens you are authorized to inspect and avoid placing production credentials in shell history or logs.