dsh-tool-jwt

Working with JWTs in day-to-day backend work often means manually decoding base64url segments, hand-assembling header/payload/signature for test tokens, or trying to verify an HMAC in your head. dsh-tool-jwt collapses these chores into three deterministic actions. decode parses the header and payload into JSON and computes expiry status against the current clock without verifying the signature, making it ideal for a quick look at a token content. sign issues an HS256 token with automatic iat and optional exp. verify runs the full validation chain: it enforces alg=HS256, compares the signature with crypto.timingSafeEqual to resist timing attacks, and checks expiry with an optional leewaySeconds tolerance.

The plugin is a pure-function implementation with zero runtime dependencies, relying only on Node built-in crypto. Its security boundaries are deliberate: verify rejects alg=none and any non-HS256 algorithm to block downgrade attacks; token, secret, and payload are capped at 16KB, 4KB, and 8KB respectively and rejected at the entry point when exceeded; secret and secretBase64url are mutually exclusive, the latter supporting RFC 7515 binary key vectors and JWK k values. Signature correctness is verified byte-for-byte against the official HS256 test vectors in RFC 7515 Appendix A.1.

It is built for backend developers who regularly inspect, craft, or validate JWTs: debugging token content in staging or production, generating test credentials during integration testing, verifying gateway or downstream auth logic, or quickly demoing JWT structure in docs and teaching. It is not intended for production key management or high-throughput signing services; its role is a developer debugging tool, not a runtime component.