1. Overview

TokenGUARD is a free, fully offline JWT inspector. A JWT (JSON Web Token) is a bearer token made of three Base64Url segments: header.payload.signature. TokenGUARD decodes the header and claims, interprets the fields, flags risks and can verify the signature.

2. Installation

WPF .NET application (Windows). Self-contained, no external dependency.

1. Open TokenGUARD.csproj in Visual Studio (target net10.0-windows).
2. Build / run. No NuGet package or configuration required.

3. Usage

1. Paste a token in the top box (a leading Bearer prefix is accepted and stripped).
2. Click Decode.
3. Sample inserts a demo token (HS256, Entra-like claims) and pre-fills the secret so you can test verification. Clear resets everything.

4. Reading the results

Header and Payload

Both JSON objects are shown pretty-printed. The header holds the algorithm (alg), type (typ) and key id (kid). The payload holds the claims.

Interpreted claims

Each claim is listed with its value and meaning. Time fields (exp, nbf, iat) are converted to readable dates.

Time validity

Colored summary: valid for ..., expired ... ago or not yet valid.

Risk analysis

Flags, for example: alg = none (unsigned token), symmetric HMAC, missing exp, excessive lifetime, missing aud / iss, iat in the future.

5. Signature verification

Optional and offline. Provide the key material then click Verify signature:

Result: valid, invalid, or unsupported. HMAC comparison is constant-time.

6. Common Entra claims

7. Privacy

TokenGUARD makes no network request. Pasted tokens, secrets and keys stay in local memory and are never saved or transmitted. Closing the app clears everything.

8. Troubleshooting