JWT JTI Format Validator

You turned on token revocation, so every JWT id now ends up in a denylist. Then the question shows up: is the identifier your issuer mints, something like sess_4471, actually good enough? RFC 7519 says the jti must be unique across issuers and hard to guess, yet it never pins down a format. That gap is where teams slip. Paste your value here and you get a one-line verdict on its shape.

Inside it is a ladder of checks in fixed order. An empty box returns invalid. If the string matches the UUID layout (hex groups of 8-4-4-4-12), the answer reads OK — UUID v plus the version digit, pulled straight from character 15. Otherwise: fewer than 16 characters returns FRACO (weak) with the count, anything outside A-Z, a-z, 0-9, hyphen and underscore returns AVISO (warning), and whatever is left returns OK with the length. It re-runs on every keystroke.

Shape is only half the job. The script cannot tell whether that jti was issued before, or whether a random generator produced it: twenty repeated letter a's come back as OK — 20 chars, and the all-zero nil UUID comes back as UUID v0. Read it as triage, never as a security audit. To generate one, use crypto.randomUUID() or 16 CSPRNG bytes in base64url, and keep jti plus exp server-side. Everything runs in your browser, and the verdict wording is still Portuguese.