JWT (JSON Web Token) debugger (jwt.io)

You should see the comments.

With similar web apps (e.g. hashing of passwords) I was thinking it would be great to be able to show to the user that this web page can't send data anywhere once it is loaded

(I understand that this might be tricky or even impossible (?) to ensure in browsers but it would be interesting to be able to give and prove guarantees like that to the user)

Within my team I call this the best website in the world.

For the uninitiated:

> Unlike JSON Web Tokens (JWT), which gives developers more than enough rope with which to hang themselves, Paseto only allows secure operations. JWT gives you "algorithm agility", Paseto gives you "versioned protocols". It's incredibly unlikely that you'll be able to use Paseto in an insecure way.

I have yet to see a criticism of JWT that doesn't devolve into developers not understanding them and/or misusing them.

Like, I know some devs use them for stateless auth, which means you can't revoke a token, so a stolen token is guaranteed valid until expiration, but I'd file that under misuse.

I'm not sure what you're trying to say here? Only one of these is a valid JWT.

B?

You can recognize JWTs without decoding by checking the string format:

JSON Web Tokens follow this format → ALGO+TokenType.Payload.Signature

So obviously the only valid JWT in your question is “B”.

    B) eyJhbGciOiJIUzM4NCIsInR5cCI6IkpXVCJ9
       .
       eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6
       IkhpIEhhY2tlciBOZXdzIiwiaWF0IjoxNTE2
       MjM5MDIyfQ
       .
       IlIR9_imqGCgEVG_QUb4LhDwSeNhYc50t3Ij
       5x126scVNJFQqCveblmHx__tqjaI

But this does not matter because you are not supposed to decode random strings expecting them to be JSON Web Tokens. That would be as stupid as assuming that any 32-bytes string is MD5 or any 40-bytes string is SHA1, etc. You either know what your input’s format is or you do not in which case you should not even attempt to decode it because it clearly is not a valid input.

JWTs don't concern themselves with privacy, only authenticity. The fact you can read the JWT is irrelevant.

You can pretty easily parse + verify JWTs in Bash using cut + base64 + openssl, although the precise invocations depend on which "alg"s you're using.

The website source is here: https://github.com/jsonwebtoken/jsonwebtoken.github.io

I've been running a local copy since last year sometime, when the website went down when I needed it. I've also stripped away all the annoying things from the website to just get the debugger. Very easy to do!

If you want something locally and use the command line, I’ve created and maintain a jwt cli tool to encode and decode jwts. https://github.com/mike-engel/jwt-cli

I always end up using https://jwt.ms/ because it's much more lightweight.

Side note: the DuckDuckGo Firefox extension kills a lot of those analytics and tracker requests. Contrary to some of the reviews, turning it off is as easy as flipping a switch.

https://addons.mozilla.org/en-US/firefox/addon/duckduckgo-fo...

If you are not afraid of the command line, have a look at smallstep [1]. I use it all the time for JWT debugging, and it can do other things as well.

[1] https://github.com/smallstep/cli

JWT Debugger App is a good alternative. It’s cross-platform so you can install on you local desktop or just use web version whatever works for you.

https://jwtdebugger.app/

Just curious, why do you leave the signature out?

> JSON.stringify(JSON.parse(atob(TOKENHERE.split('.')[1])), null, 2);

Non-code version for mobile users.

My contribution: a bookmarklet I use to copy JWTs from my internal sites to the clipboard. Replace jwt_name with your name

javascript: (function() { var textArea = document.createElement("textarea"); textArea.value = window.sessionStorage.jwt_name; document.body.appendChild(textArea); textArea.select(); document.execCommand('copy'); document.body.removeChild(textArea); })();

I found these aliases online and have found them quite useful. Requires jq.

# JWT Payload. Provide the JWT as the argument e.g. jwtp "$JWT"

alias jwtp="jq -R 'split(\".\") | .[1] | @base64d | fromjson' <<<"

# JWT Header. Provide the JWT as the argument e.g. jwth "$JWT"

alias jwth="jq -R 'split(\".\") | .[0] | @base64d | fromjson' <<<"