Jwt Validate

This validates JWTs by checking structure, claims, and signatures in that order, stopping at the first failure. It handles HMAC, RSA, and ECDSA using secrets, PEM keys, or JWKS endpoints. The skill is paranoid about security in the right ways: it never trusts the token's alg header to prevent algorithm confusion attacks, always uses explicit algorithm allowlists, and passes secrets through environment variables instead of command line args to avoid shell history exposure. It gives you a clear pass/fail report with specifics like expiration times and which check failed. If you don't provide a key, it validates structure and claims but explicitly tells you the signature wasn't verified.

skills.sh installs: 658
GitHub stars: 20
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jsonwebtoken/jwt-skills --skill jwt-validate --agent claude-code

Installs into .claude/skills of the current project.

Files

JWT Validate

Verify a JWT's signature and validate its claims. Confirms the token is authentic, unexpired, and structurally sound.

Validation Order

Check in this order. Stop and report at the first failure.

1. Structure

Exactly 3 dot-separated parts, each valid base64url
Header and payload parse as valid JSON
Header contains alg; alg is not none (unless explicitly expected)

2. Claims

exp must be in the future (report time until expiry or how long ago it expired)
nbf must be in the past or present
iat must be in the past; flag if > 30 days old
iss, aud, sub — if user provides expected values, they must match
Allow 60 seconds clock skew tolerance on all time checks

3. Signature

Requires the user to provide a secret, PEM public key, or JWKS URI. Always pass secrets and tokens via inline env vars to avoid shell history exposure.

Node.js (preferred):

First, ensure jose is available — install it globally if missing:

node --input-type=module -e "await import('jose')" 2>/dev/null || npm install -g jose

Then verify the token:

SKILL.md on GitHub

Details

Repository: github.com/jsonwebtoken/jwt-skills
First seen: Jun 3, 2026

More from jsonwebtoken/jwt-skills

All 3