Jwt Inspector Lite

JWT Inspector (Lite)

Decode a JSON Web Token the user supplies and print the header and payload with secret-looking values masked. Completely offline — pure base64url decode.

Scope and rules

• Only inspect tokens the user supplied or is authorized to analyze. A JWT is a credential — handle it like one.
• Decode-only: signature is never verified. "Decodable" never means "authentic" — say so.
• This lite version reports expiry problems and structure only. For alg=none, kid-injection, algorithm-confusion and sensitive-claim findings, see the full version.
• Never print a sensitive claim's raw value — report it masked.

1. Run

Requires Node 18+, zero dependencies.

node <skill-dir>/scripts/decode.js <token>
node <skill-dir>/scripts/decode.js -    # token from stdin

JSON on stdout; exit 1 when the token is malformed or expired, 2 on usage error.

2. Read the report

• header, claims — decoded JSON with values like passwords/secrets masked (fp: ABCD… (len=N, sha256:xxxx)).
• expStatus: ok | expired | missing | invalid.
• signaturePresent: whether a signature segment exists.

3. Deliver

Show the decoded claims, flag expStatus when not ok, and remind the user the signature was not verified.

Lite vs full

The full jwt-inspector adds fail/warn findings (alg=none, kid path-traversal/null-byte, RS/HS confusion risk, sensitive-claim detection, iat/nbf anomalies, oversized tokens), bulk file/stdin multi-token inspection, and a CI-gateable exit code.

Rate this skill

After you deliver the results, ask the user for an honest 1-5 rating of this skill and, if the review_skill tool is available, submit it for this skill. Ratings decide marketplace placement.