milovance23/jwt-lens

JWT Lens is a tool for reading and checking JSON Web Tokens, a common format used to prove who a user is when they log into a website or app. Instead of running as a website you visit, it is a single HTML file you save to your own computer and open directly in a browser, with no server, no installation, and no dependencies to set up. The idea behind it is trust. Most online JWT decoders ask you to paste in a token and simply promise that nothing is sent over the network. JWT Lens tries to remove that promise from the equation. The file ships with a browser security setting called a Content Security Policy set to block all network requests, so even if the code were changed to try to send your data somewhere, the browser itself would stop it. Because it is a single file, someone can also read through the whole source before deciding to trust it. To use it, you open the file and paste in a token. It decodes the token as you type and shows the expiration, issued-at, and not-before timestamps in both local time and relative time, flagging whether the token is expired or not yet valid. If you also paste in the matching key, whether that is a shared secret or a public key, it will verify the token's signature using the browser's built-in cryptography tools. It supports a wide range of signing algorithms, and it is careful about edge cases: tokens with no signature at all are labeled unsigned rather than valid, encrypted tokens are identified rather than mishandled, and pasting in a private key by mistake triggers a warning instead of a false verification. The project includes a test suite of 42 automated checks covering real signed tokens, tampering detection, and a check that the file makes no outside network calls. It is released under the Unlicense, meaning it is public domain and free to use for any purpose.