JWT / API Security Checklist
Check tokens for weak secrets, long expiration, alg:none and missing issuer or audience.
- Generated locally in your browser
- We do not store your passwords
Input
Secret
Checks
- Pass · Algorithm looks acceptable.
- Fail · The shared secret is too short or low-entropy for HMAC.
- Warning · Expiration is more than 7 days away.
- Pass · Issuer is present.
- Pass · Audience is present.
- Pass · Subject is present.