Arostik Logo
ArostikVLARCK

Micro-Technology Solutions

Web Crypto & RFC 7519 Tokens

Decoder JWT & Signature Validator

Paste, decode, audit, verify and even generate JSON Web Tokens — without them ever leaving your browser.

100% local — this token is never sent to any server. Everything is processed right here, in your browser.

RFC 7519 Architecture: JSON Web Tokens (JWT)

Base64Url structure, standard claims, signature algorithms, and stateless security.

JWT Anatomy (Header, Payload, Signature)

A JWT comprises three dot-separated Base64Url parts: Header (algorithm metadata), Payload (user claims), and Signature (cryptographic tamper-proof proof).

Symmetric (HS256) vs Asymmetric (RS256/ES256)

HMAC relies on a shared symmetric secret. Microservices favor asymmetric RS256/ES256 where an Auth Server signs with a private key and consumers verify with public keys.

Registered Claims (exp, iat, nbf, iss, aud)

RFC 7519 establishes UNIX epoch timestamps for `exp` (expiration), `iat` (issued at), and `nbf` (not before), alongside `iss` (issuer) and `aud` (audience).

Short-Lived Access Tokens + Refresh Tokens

Access Tokens should have short lifespans (5-15 mins). Long-term session continuity is handled via opaque Refresh Tokens stored in secure `HttpOnly` cookies.

JWT Verification, Signature & Expiry Troubleshooting

Step-by-step fixes for expired tokens, signature mismatches, and algorithm exploits.

Issue 1

TokenExpiredError / Clock Skew Discrepancy

⚡ Quick Fix:Refresh the token or add `clockTolerance: 30` (seconds) in `jwt.verify()` to accommodate small server clock drifts.
🔧 Technical Fix:Sync server clocks via NTP and verify `exp` timestamps use UNIX seconds instead of milliseconds.
Issue 2

Invalid Signature: Secret Mismatch or PEM Format Error

⚡ Quick Fix:Test the signature with your secret in this tool's validator to verify byte-for-byte matching.
🔧 Technical Fix:When loading RSA keys from `.env`, replace escaped `\n` literals with actual newline characters.
Issue 3

Algorithm Confusion Exploit & 'alg: none' Bypass

⚡ Quick Fix:Always pass explicit algorithm whitelists to the verifier: `{ algorithms: ['RS256'] }`.
🔧 Technical Fix:Never let untrusted header `alg` fields dictate verification routines; reject any token missing rigorous cryptographic pinning.
Issue 4

Insecure Storage in localStorage & XSS Token Theft

⚡ Quick Fix:Store authentication tokens in `HttpOnly; Secure; SameSite=Strict` cookies to block JavaScript access.
🔧 Technical Fix:Adopt in-memory Access Tokens in client state combined with an HttpOnly Refresh cookie for robust defense.

Did You Know? JWT Standard Trivia

Official 'jot' pronunciation, the 4KB header limit, and the stateless revocation paradox.

🗣️

Official Pronunciation: JWT is Pronounced 'Jot'

Section 1 of RFC 7519 explicitly specifies: 'The suggested pronunciation of JWT is the same as the English word *jot*'.

📦

The 4KB HTTP Header & Cookie Overflow

Servers like Nginx enforce 4KB-8KB request header limits. Overloading JWT payloads triggers HTTP `431 Request Header Fields Too Large` errors.

🔄

The Revocation Paradox: Stateless Tokens Can't Be Killed

Because JWT verification is stateless without database roundtrips, valid signatures remain valid until `exp`. Early revocation requires stateful blacklists like Redis.

📜

JOSE: The Complete Cryptographic Family

JWT belongs to the IETF JOSE suite alongside JWS (signatures), JWE (encryption), JWK (key representations), and JWA (algorithms).