JWT Decoder & Verifier, Header & Payload Inspector, HMAC-SHA256 Signature Checker
JSON Web Tokens (JWT) provide stateless, cryptographically signed authentication tokens across modern web applications, microservices, and OAuth 2.0 / OpenID Connect authorization flows. The JWT Inspector decodes the standard three-part token structure (Header, Payload, Signature) into readable JSON, verifies claim expiration timestamps, and tests HMAC-SHA256 signatures directly within browser memory.
A security engineer investigates an expired authentication token received from a mobile client: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ1c3JfNDkyMSIsInJvbGVzIjpbImFkbWluIiwiZWRpdG9yIl0sImlhdCI6MTczNTcwODgwMCwiZXhwIjoxNzM1NzEyNDAwfQ.example_sig. Pasting the token decodes the Header (specifying algorithm HS256) and reveals Payload claims: Subject usr_4921, permissions array ["admin", "editor"], and an exp claim of 1735712400. The tool evaluates the timestamp against current system time, flagging the token as expired. Entering the shared HMAC secret key in the verification field triggers client-side signature computation via the Web Crypto API, confirming whether the cryptographic signature matches the header and payload payload.
Token parsing and cryptographic verification utilize native Web Cryptography primitives (crypto.subtle.verify), ensuring sensitive enterprise credentials and secrets remain strictly client-side.
Core Architecture & Mathematical Formula
JWT = Base64URL(Header) . Base64URL(Payload) . Base64URL(Signature) ; Signature = HMAC-SHA256(Header.Payload, Secret)
Validates the three-part dot-delimited compact serialization format; decodes Base64URL byte arrays and recalculates HMAC signatures using SubtleCrypto.
Best Practices & Essential Guidelines
- Always Inspect the Algorithm Header for 'none' Vulnerabilities: Verify that incoming JWTs enforce expected algorithms (e.g. HS256, RS256) and reject insecure 'alg': 'none' header manipulations.
- Check the 'exp' (Expiration Time) Claim on Every Validation: Stateless JWTs cannot be revoked without token blacklisting; ensure client tokens carry short lifespans (e.g. 15 minutes) supplemented by secure refresh tokens.
- Avoid Storing Confidential Secrets in JWT Payloads: Because JWT payloads are Base64URL-encoded rather than encrypted, anyone who inspects the token can read payload claims; never store raw passwords or unencrypted PII.
- Verify Signature Integrity Before Trusting Payload Claims: Never grant user permissions or administrative access based solely on decoded payload JSON without cryptographically verifying the signature against your secret or public key.
