Jwt Inspector

Decode and statically inspect JSON Web Tokens for the security problems that actually get exploited — alg=none, RS/HS algorithm-confusion risk, hostile kid header values (path traversal, null bytes), missing or far-future expiry, and sensitive claims leaked into the payload.

Decode-only by design: it never verifies signatures and never phones a JWKS endpoint, so it's safe to point at captured tokens. The JSON report shows the decoded header and claims with every secret-looking value masked (first 4 chars + length + sha256 prefix), plus findings[] with severity and rationale. Exit code 1 on findings — drops into CI or a pre-deploy check on captured tokens. Handles single tokens, files with one token per line, stdin pipes, and Bearer prefixes. Node 18+, zero dependencies.