dsh-jwt

Debugging an API call often leaves you staring at a long, opaque JWT string with no fast way to inspect its claims or confirm whether it has already expired. dsh-jwt closes that loop: a single jwt_decode call inside a session returns the header and payload as structured data, plus a straightforward expiration check, so you do not need to open a browser extension or copy the token into an online decoder.

The implementation is pure Node with no third-party crypto dependencies. It does exactly two things: split the three base64url segments into header and payload, then compare the exp field against the current clock. It intentionally does not verify the signature, because validation belongs to the server. The scope is narrow by design, keeping the tool transparent and easy to audit.

If you are a backend engineer who inspects token structure often, a DevOps person tracing auth pipelines, or a security reviewer who just wants to read what a credential actually asserts, dsh-jwt is a lightweight, zero-dependency utility you can pull out of any session when you need a quick look under the hood.