JWT Extension | Secure Your App with JSON Web Tokens (ONLY FOR TEST PURPOSES)

Extensions
1

The image displays the JWT (JSON Web Token) logo with colorful segments arranged in a circular pattern next to the text "JWT JSON WEB Token" on a dark background. (Captioned by AI)
The image displays the JWT (JSON Web Token) logo with colorful segments arranged in a circular pattern next to the text "JWT JSON WEB Token" on a dark background. (Captioned by AI)800×450 20.7 KB

🧩 JWT

An extension for MIT App Inventor 2.
JWT Extension to encode, decode, verify JSON Web Tokens using HMAC-SHA256

Intro

Create, decode, verify, and inspect JWT (JSON Web Tokens) right inside your apps. This extension allows you to implement secure authentication, authorization, and data protection using HMAC-SHA256 signing — just like web APIs and modern backends.

:package: Features

  • :locked: Create secure JWT tokens with a secret key
  • :magnifying_glass_tilted_left: Decode tokens and read payload as JSON
  • :white_check_mark: Verify token authenticity using HMAC-SHA256
  • :hourglass_done: Check expiration using exp field
  • :key: Get specific values from payload
  • :hammer_and_wrench: List all payload keys
  • :eye: Pretty print payload for debugging

:brick: Blocks & Usage

:puzzle_piece: CreateToken

CreateToken_Method

:wrench: Description:
Signs a payload (JSON) with your secret key using HMAC-SHA256 and returns a full JWT token.
:pushpin: Use case: After login, generate a secure token to authenticate API requests.
:white_check_mark: payload = {"id": "user123", "role": "admin"}

:white_check_mark: secret = "mySecretKey"

:puzzle_piece: DecodeToken

DecodeToken_Method

:wrench: Description:
Returns the decoded payload as a JSON string.
:pushpin: Use case: Read stored data (like user ID or role) without verifying the token.

:puzzle_piece: VerifyToken

VerifyToken_Method

:wrench: Description:
Checks if the token’s signature is valid using the same secret. Returns true or false.
:pushpin: Use case: Prevent tampered tokens from being accepted.

:puzzle_piece: GetPayloadValue

GetPayloadValue_Method

:wrench: Description:
Retrieves a specific field (e.g., id, role, email) from the payload.
:pushpin: Use case: Display the current user’s role or ID from the stored JWT.

:puzzle_piece: IsExpired

IsExpired_Method

:wrench: Description:
Checks if the token is expired using the exp field (UNIX timestamp in seconds).
:pushpin: Use case: Auto-logout users after token expiry.

:puzzle_piece: PrettyPrintPayload

PrettyPrintPayload_Method

:wrench: Description:
Returns the payload in a formatted, readable JSON string (indented).
:pushpin: Use case: Debug your token structure during development.

:puzzle_piece: GetPayloadKeys

GetPayloadKeys_Method

:wrench: Description:
Returns a list of all field names in the payload.
:pushpin: Use case: Show all available data stored in the token.

:light_bulb: Real-World Use Cases

  • :locked_with_key: Token-based login system
  • :bust_in_silhouette: Store user identity, role, or access scopes
  • :counterclockwise_arrows_button: Call secure web APIs with JWT in the Authorization header
  • :stopwatch: Automatically logout users on token expiration
  • :bar_chart: Debug and inspect token content for development

:memo: Specifications

:package: Package: com.mahir.jwt
:floppy_disk: Size: 6.00 KB
:mobile_phone: Minimum API Level: 7
:date: Updated On: 2025-07-02T18:00:00Z
:laptop: Built & documented using: FAST-CLI v2.6.0

Download

AIX : com.mahir.jwt.aix (6.0 KB)

1 Like
2

I don’t get it, how is it secure? The secret key is still exposed in the app. Anyone can extract it and create a new token.

A true JWT is created inside your backend server without exposing the secret key anywhere.

By the way, anyone who wants to implement JWT in their app with a server can contact me :grin:

1 Like
3

You’re absolutely right — in a true secure production setup, JWTs should be generated and signed on a backend server, where the secret key is never exposed to the client.

This extension is intended for:

Educational use

Offline/local use cases

Testing or internal apps where security isn’t a critical concern

App-level token-like storage (e.g., not for real auth)

1 Like