TECHNICAL MODEL

Small surface area. Explicit limits.

easyjwt is a static client application. It has no trusted backend and does not make security decisions for your application.

Supported JWS algorithms

HS256, HS384, HS512; RS256, RS384, RS512; PS256, PS384, PS512; and ES256, ES384, ES512. HMAC uses a text shared secret. RSA and ECDSA verification accepts an SPKI public PEM; signing accepts a PKCS#8 private PEM.

What the linter does

It identifies malformed or risky header/claim patterns, suspicious payload fields, and local timestamp conditions. Findings are diagnostic hints, not a complete authorization review and not proof that a token is secure.

What it does not do

It does not decrypt JWE tokens, resolve remote JWKS keys, validate issuer/audience against your service, save keys, or replace server-side signature and claim validation. It refuses to generate alg: none tokens.

Trust boundary

The source is delivered as static files. Review the deployed assets and the site’s Content Security Policy if you need stronger assurance. Browser extensions and a compromised host/device are outside the protection boundary.