-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathjwt-decoder.html
More file actions
399 lines (366 loc) Β· 25.7 KB
/
Copy pathjwt-decoder.html
File metadata and controls
399 lines (366 loc) Β· 25.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
<!DOCTYPE html>
<html lang="en">
<head>
<include src="_partials/meta-base.html"></include>
<title>JWT Decoder β HTML Tools</title>
<meta name="description" content="Paste any JWT token and instantly see the decoded header, payload, and signature. Claim timestamps shown as human-readable dates β runs in your browser, no tracking.">
<link rel="canonical" href="https://tools.mazipan.space/jwt-decoder">
<meta property="og:title" content="JWT Decoder β HTML Tools">
<meta property="og:description" content="Paste any JWT token and instantly see the decoded header, payload, and signature. Claim timestamps shown as human-readable dates β runs in your browser, no tracking.">
<meta property="og:url" content="https://tools.mazipan.space/jwt-decoder">
<meta name="twitter:title" content="JWT Decoder β HTML Tools">
<meta name="twitter:description" content="Paste any JWT token and instantly see the decoded header, payload, and signature. Claim timestamps shown as human-readable dates β runs in your browser, no tracking.">
<include src="_partials/meta-social.html"></include>
<link rel="icon" type="image/png" sizes="32x32" href="favicon-jwt-decoder.png">
<include src="_partials/head-fonts.html"></include>
<link rel="stylesheet" href="styles.css">
<style>
.jwt-hdr { color: #ff7b72; }
.jwt-pay { color: #d2a8ff; }
.jwt-sig { color: #79c0ff; }
.jwt-dot { color: #6b7280; }
.claim-grid {
display: grid;
grid-template-columns: 7rem 1fr;
gap: 0.5rem 1rem;
padding: 0.55rem 1rem;
border-bottom: 1px solid #1f2937;
align-items: baseline;
}
.claim-grid:last-child { border-bottom: none; }
.claim-key {
font-family: 'IBM Plex Mono', ui-monospace, monospace;
font-size: 0.72rem;
color: #f78c6c;
}
.claim-val {
font-family: 'IBM Plex Mono', ui-monospace, monospace;
font-size: 0.8rem;
color: #e5e7eb;
word-break: break-word;
}
.claim-date { display: block; font-size: 0.68rem; color: #9ca3af; margin-top: 0.15rem; }
.badge-ok { display: inline-block; font-size: 0.62rem; padding: 0.05rem 0.4rem; border-radius: 4px; background: #052e16; color: #4ade80; margin-left: 0.4rem; vertical-align: middle; }
.badge-exp { display: inline-block; font-size: 0.62rem; padding: 0.05rem 0.4rem; border-radius: 4px; background: #450a0a; color: #f87171; margin-left: 0.4rem; vertical-align: middle; }
.section-card { border: 1px solid #1f2937; background: #080f1a; border-radius: 0.5rem; overflow: hidden; }
.section-head { padding: 0.4rem 1rem; font-size: 0.66rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.1em; border-bottom: 1px solid #1f2937; }
</style>
<include src="_partials/head-theme.html"></include>
<!-- BEGIN:json-ld generated by scripts/generate-sections.mjs β re-run after editing tools.json -->
<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebApplication","name":"JWT Decoder","url":"https://tools.mazipan.space/jwt-decoder","description":"Paste any JWT token to decode the header, payload, and signature β claim timestamps shown as human-readable dates, exp shows a live valid/expired badge. Runs in your browser β no installs, no tracking.","applicationCategory":"DeveloperApplication","operatingSystem":"Any","browserRequirements":"Requires JavaScript","offers":{"@type":"Offer","price":"0","priceCurrency":"USD"},"isPartOf":{"@type":"WebSite","name":"HTML Tools","url":"https://tools.mazipan.space/"}}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"HTML Tools","item":"https://tools.mazipan.space/"},{"@type":"ListItem","position":2,"name":"JWT Decoder","item":"https://tools.mazipan.space/jwt-decoder"}]}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"FAQPage","mainEntity":[{"@type":"Question","name":"Does this verify the JWT signature?","acceptedAnswer":{"@type":"Answer","text":"No. Signature verification requires the secret key or the RSA/ECDSA public key, which the tool never has. The decoder only base64url-decodes the header and payload, which is safe and useful for inspecting contents without needing the key."}},{"@type":"Question","name":"Is it safe to paste a real JWT here?","acceptedAnswer":{"@type":"Answer","text":"The decoding happens entirely in your browser β nothing is sent to a server. That said, JWTs can carry access tokens. Treat them like passwords: paste production tokens only in a trusted environment, and rotate any you paste into a public or shared machine."}},{"@type":"Question","name":"What do the colour-coded token segments mean?","acceptedAnswer":{"@type":"Answer","text":"Red is the header (algorithm and type), purple is the payload (claims), and blue is the signature β the same colour convention used by jwt.io."}},{"@type":"Question","name":"What is exp / nbf / iat?","acceptedAnswer":{"@type":"Answer","text":"exp (expiration) is the Unix timestamp after which the token is no longer valid. nbf (not before) is the earliest it should be accepted. iat (issued at) is when it was created. All three are rendered as human-readable UTC dates alongside the raw epoch value."}},{"@type":"Question","name":"Does the tool support JWE or nested JWTs?","acceptedAnswer":{"@type":"Answer","text":"JWS compact serialisation (the common 3-part JWT) is supported. JWE (encrypted tokens, 5 parts) and nested JWTs are not decoded automatically β paste the inner token separately if needed."}}]}</script>
<!-- END:json-ld -->
</head>
<body class="bg-gray-950 text-gray-200 min-h-screen flex flex-col">
<header class="border-b border-gray-800 px-6 py-4">
<nav aria-label="Breadcrumb" class="max-w-[900px] mx-auto flex items-center gap-3">
<a href="index.html" class="no-underline text-white font-bold text-lg tracking-tight hover:text-blue-400 transition-colors">HTML Tools</a>
<span class="text-gray-700">/</span>
<span class="text-gray-400 text-sm" aria-current="page">π JWT Decoder</span>
</nav>
</header>
<main class="max-w-[900px] mx-auto w-full flex-1 py-8 px-6">
<header class="mb-7">
<h1 class="text-3xl font-bold text-white flex items-center gap-3">π JWT Decoder</h1>
<p class="mt-1.5 text-sm text-gray-500">Paste a JWT token to decode and inspect the header, payload, and signature.</p>
</header>
<!-- Input -->
<div class="mb-4">
<div class="flex items-center justify-between mb-2">
<label class="text-xs font-semibold text-gray-500 uppercase tracking-wide" for="jwt-input">JWT Token</label>
<button onclick="loadSample()" class="btn btn-secondary">π₯ Load sample</button>
</div>
<textarea id="jwt-input" placeholder="Paste JWT token hereβ¦" spellcheck="false" autocomplete="off" oninput="decode()"
class="w-full h-32 rounded-lg border border-gray-700 bg-gray-900 text-gray-200 font-mono text-[0.75rem] leading-relaxed p-4 resize-y outline-none focus:border-blue-400 transition-colors"></textarea>
</div>
<div id="status-bar" class="mb-5 min-h-[26px]"></div>
<!-- Colour-coded token breakdown -->
<div id="token-visual" class="hidden mb-6 p-4 rounded-lg border border-gray-800 bg-gray-900 font-mono text-[0.72rem] break-all leading-loose"></div>
<!-- Decoded sections -->
<div id="decoded" class="hidden space-y-5">
<!-- Header -->
<div>
<h2 class="text-xs font-semibold text-gray-500 uppercase tracking-wide mb-2">Header <span class="text-gray-700 font-normal normal-case">β JOSE header</span></h2>
<div class="section-card">
<div class="section-head text-red-400">Header</div>
<div id="header-rows"></div>
</div>
<details class="disclosure mt-2">
<summary>π Raw JSON</summary>
<div class="disclosure-content"><div class="disclosure-body">
<pre id="header-json" class="text-[0.72rem] text-gray-300 whitespace-pre-wrap font-mono"></pre>
</div></div>
</details>
</div>
<!-- Payload -->
<div>
<h2 class="text-xs font-semibold text-gray-500 uppercase tracking-wide mb-2">Payload <span class="text-gray-700 font-normal normal-case">β claims</span></h2>
<div class="section-card">
<div class="section-head text-purple-400">Payload</div>
<div id="payload-rows"></div>
</div>
<details class="disclosure mt-2">
<summary>π Raw JSON</summary>
<div class="disclosure-content"><div class="disclosure-body">
<pre id="payload-json" class="text-[0.72rem] text-gray-300 whitespace-pre-wrap font-mono"></pre>
</div></div>
</details>
</div>
<!-- Signature -->
<div>
<div class="flex items-center justify-between mb-2">
<h2 class="text-xs font-semibold text-gray-500 uppercase tracking-wide">Signature</h2>
<button onclick="copySig()" class="btn btn-secondary">π Copy</button>
</div>
<div class="section-card p-4">
<p id="sig-value" class="font-mono text-[0.72rem] text-blue-300 break-all mb-3"></p>
<p class="text-xs text-yellow-500/80">β οΈ Signature not verified β verification requires the secret or public key.</p>
</div>
</div>
<!-- Standard claims reference -->
<details class="disclosure">
<summary>π Standard claim names</summary>
<div class="disclosure-content"><div class="disclosure-body">
<table class="cheat-table">
<thead><tr><th>Claim</th><th>Full name</th><th>Description</th></tr></thead>
<tbody>
<tr><td>iss</td><td>Issuer</td><td>Who issued the token</td></tr>
<tr><td>sub</td><td>Subject</td><td>The entity the token is about</td></tr>
<tr><td>aud</td><td>Audience</td><td>Intended recipients</td></tr>
<tr><td>exp</td><td>Expiration Time</td><td>Token must not be accepted after this Unix timestamp</td></tr>
<tr><td>nbf</td><td>Not Before</td><td>Token must not be accepted before this Unix timestamp</td></tr>
<tr><td>iat</td><td>Issued At</td><td>When the token was issued (Unix timestamp)</td></tr>
<tr><td>jti</td><td>JWT ID</td><td>Unique identifier β used for replay prevention</td></tr>
</tbody>
</table>
</div></div>
</details>
</div>
</main>
<include src="_partials/footer-script.html"></include>
<!-- BEGIN:faq generated by scripts/generate-sections.mjs β re-run after editing tools.json -->
<section class="max-w-[900px] mx-auto w-full px-6 py-8 border-t border-gray-800">
<h2 class="text-xl font-bold text-white mb-6">FAQ</h2>
<div class="space-y-2">
<details class="disclosure">
<summary>Does this verify the JWT signature?</summary>
<div class="disclosure-content"><div class="disclosure-body">No. Signature verification requires the secret key or the RSA/ECDSA public key, which the tool never has. The decoder only base64url-decodes the header and payload, which is safe and useful for inspecting contents without needing the key.</div></div>
</details>
<details class="disclosure">
<summary>Is it safe to paste a real JWT here?</summary>
<div class="disclosure-content"><div class="disclosure-body">The decoding happens entirely in your browser β nothing is sent to a server. That said, JWTs can carry access tokens. Treat them like passwords: paste production tokens only in a trusted environment, and rotate any you paste into a public or shared machine.</div></div>
</details>
<details class="disclosure">
<summary>What do the colour-coded token segments mean?</summary>
<div class="disclosure-content"><div class="disclosure-body">Red is the header (algorithm and type), purple is the payload (claims), and blue is the signature β the same colour convention used by jwt.io.</div></div>
</details>
<details class="disclosure">
<summary>What is exp / nbf / iat?</summary>
<div class="disclosure-content"><div class="disclosure-body">exp (expiration) is the Unix timestamp after which the token is no longer valid. nbf (not before) is the earliest it should be accepted. iat (issued at) is when it was created. All three are rendered as human-readable UTC dates alongside the raw epoch value.</div></div>
</details>
<details class="disclosure">
<summary>Does the tool support JWE or nested JWTs?</summary>
<div class="disclosure-content"><div class="disclosure-body">JWS compact serialisation (the common 3-part JWT) is supported. JWE (encrypted tokens, 5 parts) and nested JWTs are not decoded automatically β paste the inner token separately if needed.</div></div>
</details>
</div>
</section>
<!-- END:faq -->
<!-- BEGIN:more-tools generated by scripts/generate-sections.mjs β re-run after editing tools.json -->
<section class="max-w-[900px] mx-auto w-full px-6 py-8 border-t border-gray-800">
<h2 class="text-xl font-bold text-white mb-6">More tools</h2>
<div class="space-y-4">
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">JSON</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/json-formatter" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">ποΈ JSON Formatter</a>
<a href="/json-to-ts" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π· JSON to TypeScript</a>
<a href="/json-diff" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π JSON Diff</a>
<a href="/json-sort" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π€ JSON Sort</a>
<a href="/csv-to-json" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π JSON β CSV</a>
<a href="/json-to-yaml" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π JSON β YAML</a>
<a href="/json-to-schema" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π‘οΈ JSON to Validator Schema</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Code</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/regex-tester" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π§ͺ Regex Tester</a>
<a href="/svg-to-jsx" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">βοΈ SVG to JSX</a>
<a href="/svg-rasterizer" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π· SVG to Raster</a>
<a href="/cron-decoder" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">β±οΈ Cron Decoder</a>
<a href="/snippet-to-image" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">πΈ Code Snippet to Image</a>
<a href="/text-diff" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Text Diff</a>
<a href="/markdown-preview" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Markdown Preview</a>
<a href="/semver-checker" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π·οΈ SemVer Checker</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Ornaments</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/gradients" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π¨ Gradients</a>
<a href="/blob" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π«§ Blob Generator</a>
<a href="/waves" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">γ°οΈ Wave Generator</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Image</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/image-compressor" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">ποΈ Image Compressor</a>
<a href="/image-resizer" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Image Resizer</a>
<a href="/image-cropper" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">βοΈ Image Cropper</a>
<a href="/image-converter" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">πΌοΈ Image Format Converter</a>
<a href="/image-watermark" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Image Watermark</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Audio</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/mp3-tag-editor" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π΅ MP3 Tag Editor</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Web / SEO</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/meta-tag-preview" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Meta Tag Preview</a>
<a href="/user-agent-parser" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π΅οΈ User Agent Parser</a>
<a href="/og-image-builder" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">πΌοΈ OG Image Builder</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Generators</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/qr-code-generator" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π± QR Code Generator</a>
<a href="/lorem-ipsum" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Lorem Ipsum Generator</a>
<a href="/avatar-generator" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π€ Avatar Generator</a>
<a href="/favicon-generator" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">β Favicon Generator</a>
<a href="/uuid-generator" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">πͺͺ UUID Generator</a>
<a href="/wheel-of-names" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π‘ Wheel of Names</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">PDF</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/pdf-merger" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π PDF Merger</a>
<a href="/image-to-pdf" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π Image to PDF</a>
<a href="/pdf-compressor" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π€ PDF Compressor</a>
<a href="/pdf-splitter" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">βοΈ PDF Splitter</a>
<a href="/pdf-page-manager" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">ποΈ PDF Page Manager</a>
<a href="/pdf-watermark" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π§ PDF Watermark</a>
<a href="/pdf-signature" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">βοΈ PDF Signature</a>
<a href="/pdf-to-image" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">πΌοΈ PDF to Image</a>
</div>
</div>
<div>
<h3 class="text-xs font-semibold uppercase tracking-wider text-gray-500 mb-2">Time</h3>
<div class="flex flex-wrap gap-x-5 gap-y-2">
<a href="/pomodoro-timer" class="text-sm text-gray-300 hover:text-blue-400 transition-colors no-underline">π
Pomodoro Timer</a>
</div>
</div>
</div>
</section>
<!-- END:more-tools -->
<footer class="max-w-[900px] mx-auto w-full py-8 px-6 border-t border-gray-800 text-center text-sm text-gray-600">
<div>© <span id="year"></span> <a href="https://mazipan.space" rel="noreferrer noopener" target="_blank" class="text-blue-400 transition-colors">Irfan Maulana</a> & Claude</div>
<div><span id="deploy-time"></span></div>
<div><span id="commit-sha"></span><a href="https://github.com/mazipan/html-tools" rel="noreferrer noopener" target="_blank" class="text-blue-400 transition-colors">Source</a></div>
<div><a href="design-system.html" rel="nofollow" class="text-blue-400 transition-colors">Design system</a></div>
<div><a href="https://baca-quran.id" rel="noreferrer noopener" target="_blank" class="text-blue-400 transition-colors">Baca Quran</a> Β· <a href="https://games.mazipan.space" rel="noreferrer noopener" target="_blank" class="text-blue-400 transition-colors">Games</a></div>
</footer>
<script>
const inputEl = document.getElementById('jwt-input');
const statusEl = document.getElementById('status-bar');
const visualEl = document.getElementById('token-visual');
const decodedEl = document.getElementById('decoded');
// Standard jwt.io sample β exp is intentionally in the past to demonstrate the expired badge
const SAMPLE = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJleHAiOjE1MTYyNDI2MjJ9.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c';
const TS_CLAIMS = new Set(['iat', 'exp', 'nbf', 'auth_time', 'updated_at', 'rat', 'cts']);
function b64urlDecode(str) {
const s = str.replace(/-/g, '+').replace(/_/g, '/');
return atob(s + '='.repeat((4 - s.length % 4) % 4));
}
function esc(s) {
return String(s).replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>');
}
function renderRows(obj, containerId, isPayload) {
const container = document.getElementById(containerId);
container.innerHTML = '';
const now = Math.floor(Date.now() / 1000);
for (const [key, val] of Object.entries(obj)) {
const row = document.createElement('div');
row.className = 'claim-grid';
const keyDiv = document.createElement('div');
keyDiv.className = 'claim-key';
keyDiv.textContent = '.' + key;
const valDiv = document.createElement('div');
valDiv.className = 'claim-val';
const raw = typeof val === 'object' ? JSON.stringify(val) : String(val);
if (isPayload && TS_CLAIMS.has(key) && typeof val === 'number') {
const dateStr = new Date(val * 1000).toUTCString();
let badge = '';
if (key === 'exp') {
badge = val < now
? '<span class="badge-exp">expired</span>'
: '<span class="badge-ok">valid</span>';
}
valDiv.innerHTML = `${esc(raw)}${badge}<span class="claim-date">${esc(dateStr)}</span>`;
} else {
valDiv.textContent = raw;
}
row.appendChild(keyDiv);
row.appendChild(valDiv);
container.appendChild(row);
}
}
function decode() {
const raw = inputEl.value.trim();
if (!raw) { reset(); return; }
const parts = raw.split('.');
if (parts.length !== 3) {
statusEl.innerHTML = `<div class="error-bar">β Invalid β expected 3 dot-separated parts, got ${parts.length}.</div>`;
visualEl.classList.add('hidden');
decodedEl.classList.add('hidden');
return;
}
let header, payload;
try {
header = JSON.parse(b64urlDecode(parts[0]));
payload = JSON.parse(b64urlDecode(parts[1]));
} catch (e) {
statusEl.innerHTML = `<div class="error-bar">β Decode failed: ${esc(e.message)}</div>`;
visualEl.classList.add('hidden');
decodedEl.classList.add('hidden');
return;
}
statusEl.innerHTML = `<span class="text-sm text-green-400 font-medium">β
Valid JWT <span class="text-gray-500 font-normal">(3 parts detected)</span></span>`;
visualEl.innerHTML =
`<span class="jwt-hdr">${esc(parts[0])}</span>` +
`<span class="jwt-dot">.</span>` +
`<span class="jwt-pay">${esc(parts[1])}</span>` +
`<span class="jwt-dot">.</span>` +
`<span class="jwt-sig">${esc(parts[2])}</span>`;
visualEl.classList.remove('hidden');
renderRows(header, 'header-rows', false);
renderRows(payload, 'payload-rows', true);
document.getElementById('header-json').textContent = JSON.stringify(header, null, 2);
document.getElementById('payload-json').textContent = JSON.stringify(payload, null, 2);
document.getElementById('sig-value').textContent = parts[2];
decodedEl.classList.remove('hidden');
}
function reset() {
statusEl.innerHTML = '';
visualEl.classList.add('hidden');
decodedEl.classList.add('hidden');
}
function copySig() {
const sig = document.getElementById('sig-value').textContent;
if (sig) navigator.clipboard.writeText(sig);
}
function loadSample() {
inputEl.value = SAMPLE;
decode();
}
inputEl.focus();
</script>
</body>
</html>