JWT Debugger & Security Inspector

// Verify and decode a JWT 100% locally in browser using Web Crypto API
export async function verifyHS256Token(
  jwt: string,
  secret: string
): Promise<{ valid: boolean; header: any; payload: any; error?: string }> {
  try {
    const parts = jwt.split('.');
    if (parts.length !== 3) {
      return { valid: false, header: null, payload: null, error: 'Invalid JWT segment count' };
    }

    const [headerB64, payloadB64, signatureB64] = parts;

    // Helper: Base64URL to Uint8Array
    const base64UrlToBytes = (base64Url: string) => {
      let b64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
      while (b64.length % 4) b64 += '=';
      const raw = atob(b64);
      return Uint8Array.from(raw, (c) => c.charCodeAt(0));
    };

    // Decode and parse Header and Payload
    const header = JSON.parse(new TextDecoder().decode(base64UrlToBytes(headerB64)));
    const payload = JSON.parse(new TextDecoder().decode(base64UrlToBytes(payloadB64)));

    // Reject dangerous alg:none vulnerabilities
    if (!header.alg || header.alg.toLowerCase() === 'none') {
      return { valid: false, header, payload, error: 'Rejected algorithm: none' };
    }

    if (header.alg !== 'HS256') {
      return { valid: false, header, payload, error: `Unsupported algorithm: ${header.alg}` };
    }

    // Import symmetric secret key into Web Crypto
    const enc = new TextEncoder();
    const cryptoKey = await crypto.subtle.importKey(
      'raw',
      enc.encode(secret),
      { name: 'HMAC', hash: 'SHA-256' },
      false,
      ['verify']
    );

    // Verify signature against message buffer
    const messageData = enc.encode(`${headerB64}.${payloadB64}`);
    const signatureBytes = base64UrlToBytes(signatureB64);

    const isSigValid = await crypto.subtle.verify(
      'HMAC',
      cryptoKey,
      signatureBytes,
      messageData
    );

    if (!isSigValid) {
      return { valid: false, header, payload, error: 'Cryptographic signature mismatch' };
    }

    // Validate expiration claim
    const now = Math.floor(Date.now() / 1000);
    if (payload.exp && now >= payload.exp) {
      return { valid: false, header, payload, error: 'Token has expired (exp claim exceeded)' };
    }

    return { valid: true, header, payload };
  } catch (err: any) {
    return { valid: false, header: null, payload: null, error: err.message };
  }
}