Security Consultingsecurityauditjwthashing

Using JWT Decoder and Hash Tools for Security Audits

25% more findings per auditkey outcome

· Cosyslabs

Security consultants face a tooling paradox: the tools they need to inspect client systems often require sending sensitive data — tokens, hashes, session cookies — to third-party services. A freelance security consultant solved this by building their audit workflow around Dev Tools !, which runs all computation client-side with no data leaving the browser.

The Audit Challenge

During a web application security assessment, a consultant needs to inspect many types of data:

  • JWTs from authentication headers (contain user claims, algorithm declarations)
  • Password hash formats (are passwords stored with bcrypt? MD5? SHA-1?)
  • Encoded data in cookies and local storage
  • API response structures for information disclosure
  • URL encoding in redirect parameters (open redirect vectors)

Traditionally, this requires multiple tools — some online (raising data privacy concerns), some command-line (requiring environment setup on each client engagement).

The Workflow

Phase 1: Token Analysis

The first step in any web app audit is analyzing authentication tokens. The consultant decodes JWTs using the JWT Decoder and checks for:

Red flags to look for in JWT headers:
- "alg": "none"        → token has no signature (critical)
- "alg": "HS256"       → symmetric; can be brute-forced if secret is weak
- Missing "typ" field   → non-standard token

Red flags in JWT payload:
- No "exp" claim        → token never expires
- "exp" too far out     → e.g., 1 year from now
- Sensitive data in claims: email, SSN, internal role names
- "iss" pointing to unexpected domain

Finding: In 60% of audits, the consultant found JWTs with expiry times exceeding 24 hours (many were 30 days or longer), creating a long window for token theft to go undetected.

Phase 2: Hash Identification

When reviewing storage or password reset flows, the consultant uses the Hash Generator to identify hash formats. By hashing known test values and comparing output lengths and character sets:

Hash LengthLikely AlgorithmVerdict
32 hex charsMD5Critical — broken
40 hex charsSHA-1Critical — broken
60 chars, starts with $2b$bcryptAcceptable
95 chars, starts with $argon2Argon2idRecommended
Test case: hash the string "password123" with MD5
MD5("password123") = 482c811da5d5b4bc6d497ffa98491e38

If this hash appears in the database dump → all passwords are MD5 hashed
→ Report: Critical finding, immediate remediation required

Phase 3: Encoding Inspection

The consultant uses Base64 Decoder and URL Decoder to inspect encoded values in cookies, local storage, and URL parameters:

Session cookie value (base64-decoded):
eyJ1c2VySWQiOiAiYWRtaW4iLCAicm9sZSI6ICJhZG1pbiJ9
→ {"userId": "admin", "role": "admin"}

Finding: Session data stored without signature — can be forged by editing base64
Severity: Critical

Redirect parameter value (URL-decoded):
next=%2F%2Fevil.com%2Fsteal%3Ftoken%3D
→ //evil.com/steal?token=

Finding: Open redirect — attacker can redirect users to malicious domain
Severity: High

Audit Findings Summary

After incorporating Dev Tools ! into 15 client engagements:

Finding TypeFound Per Audit (avg)Previously Missed Rate
JWT algorithm issues2.3~30% (missed without tool)
Weak password hashing1.1~10%
Unsigned session data0.8~25%
Open redirects via encoding0.6~20%

The previously-missed findings were often due to time pressure — manually decoding Base64 or identifying hash algorithms was slow without tooling. With instant browser-based tools, the consultant now inspects every token, hash, and encoded value in scope.

Privacy Benefit

The critical advantage is privacy. Client security data — tokens, partial hashes, session cookies — never leaves the browser. This satisfies client NDAs that prohibit sharing data with third-party services, and removes any concern about token interception during tool submission.

Tools Used