Preset Scenarios:
Encoded Token
Screen-Share Privacy Mask Active
Raw token is shielded from video streams.
Structure breakdown:509 characters (382 bytes)
Header (alg/typ)36 chars
Payload (claims)428 chars
Signature43 chars
Exploit Sandbox
Decoded Claims
{
"alg": "HS256",
"typ": "JWT"
}Live Editable
Standard Claim Summary
ISSUER (iss)supabase
SUBJECT (sub)usr_••••
AUDIENCE (aud)authenticated
ROLE / SCOPEauthenticated
Verification & Audit
AWAITING KEY VERIFICATION
Never leaves browser memory
Expiration GaugeExpired 46m 44s ago
Expiry: Mon, 07 Sep 2026 09:33:20 GMT
exp: 1788773600
Time-Travel Drift:Current Time (Real-Time)
-3 Days+7 Days
Security Audit Findings (1)
Symmetric HMAC Algorithm Used (HS256)
Both the issuing authentication server and any verifying microservices must share the identical private secret key. If a consumer microservice is compromised, attackers can forge tokens.
Fix: For distributed microservices, prefer asymmetric signing (RS256, ES256, or EdDSA) where consumers only hold public keys.
Independent Verification: The Zero-Telemetry Guarantee
Most popular online JWT debuggers (like jwt.io and jwt.ms) transmit your raw production tokens, session identifiers, and secret keys across public internet relays where third-party CDNs and logging agents record them. Aventine Labs JWTForge™ executes 100% in your browser's Web Crypto memory engine.
# Verify independently in your own browser right now:
1. Press F12 or Ctrl+Shift+I to open Developer Tools.
2. Click the Network tab and filter by Fetch/XHR.
3. Paste any JWT, edit claims, or compute verification signatures.
• Result: Exactly 0 outbound network requests. Total cryptographic privacy.