Developer Tool · RFC 7519 · Browser-local · 2026 · Solo — pure TypeScript JWT parser architecture, algorithm risk classification, RFC 7519/7518 claim annotation DB, TDD (37 tests), Vercel production deployment
JWT Scope
A browser-local JWT forensics inspector: pure TypeScript base64url decoder, algorithm risk DB covering RFC 7518 §3, RFC 7519 claim annotations (~30 registered claims + OIDC/OAuth 2.0 extensions), live expiry countdown, and key ID detection — no jose, no jsonwebtoken, no server.
The problem
Engineers debugging authentication flows, API integrations, or security incidents regularly need to decode JWTs — from browser cookies, API responses, gRPC headers, or incident traces. jwt.io is the obvious choice, but it uploads the token to a third-party server. A locally-running forensics inspector that classifies algorithm risk, annotates every claim against RFC 7519, and shows live expiry state removes that privacy risk entirely.
Architecture
Key decisions
Pure TypeScript JWT decoder — no jose, no jsonwebtoken
The base64url decoder, JSON parser, algorithm classifier, and claim annotator are implemented from RFC 7519/7518 in ~150 lines of TypeScript with zero runtime JWT dependencies. This makes the decoder fully unit-testable, eliminates supply-chain attack surface, and guarantees tokens never leave the browser.
Algorithm risk DB covering RFC 7518 §3
Every algorithm defined in RFC 7518 §3 is classified with a risk tier: 'none' is CRITICAL (unsigned, accepts any payload), HMAC and RSA/ECDSA/PSS variants are STRONG with key-size caveats noted inline. Unknown algorithms return 'unknown' risk rather than silently failing. The RFC citation is shown alongside the risk tier for immediate verification.
RFC 7519 + OIDC Core + OAuth 2.0 claim DB with semantic annotations
A 30-entry claim annotation DB covers all RFC 7519 §4.1 registered claims, OIDC Core §5.1 standard claims (email, name, picture, azp, at_hash, nonce), OAuth 2.0 extension claims (scope, scp, permissions), and Microsoft Identity Platform claims (tid, oid, ver). Each entry includes a semantic description explaining the security implications, not just the field name.
TDD — 37 tests written and confirmed failing before implementation
All engine functions (parseJwt, computeExpiry, annotatePayload, classifyAlgorithm, formatRemainingTime) were specified as tests first. The suite covers input validation, base64url decoding, algorithm risk classification, claim annotation categories, expiry state computation, live countdown formatting, and key ID detection. Each test was run and confirmed to fail before the corresponding function was written.