JWTScope Documentation

Privacy & Security

JWTs often contain sensitive identity data. Most online decoders send your tokens to their backends for parsing. JWTScope is different:

• Local-Only Decoding: Uses base64UrlDecode logic directly in your browser.
• Zero Tracking: No logging of secrets or tokens. Verification happens entirely in your local JavaScript environment.
• Safe Sharing: Use the "Export Sanitized" feature to share token structures with your team without exposing the actual sensitive values.

Decoding & Claims Inspection

JWTScope breaks the token into its three standard components:

1. Header: Metadata about the token (algorithm, type).
2. Payload: The data (claims) stored in the token.
3. Signature: The cryptographic proof of authenticity.

Standard claims like exp (expiration), iat (issued at), and iss (issuer) are automatically translated into human-readable timestamps and labels.

Signature Verification

To verify if a token is authentic, use the Verification Section:

• HMAC (HS256/384/512): Paste your shared secret.
• RSA/ECDSA (RS256/ES256): Paste the Public Key (usually as a PEM string) to verify the asymmetric signature.

Security Auditing

The tool performs a real-time security audit on your token, flagging risks such as:

• None Algorithm: Tokens using alg: none are flagged as critical risks.
• Short Expiration: Warns if the exp claim is missing or set too far in the future.
• Weak HMAC: Flags short or easily guessable secrets if verification fails.
• Sensitive Data: Identifies if common PII (email, phone) is stored unmasked in the claims.

Frequently Asked Questions