jwt-pq-web

Website and live verifier for the jwt-pq Ruby gem.

The app serves the landing page and documentation for the gem, plus a live JWT debugger that verifies post-quantum tokens against the real jwt-pq library server-side — no JavaScript reimplementation.

Running locally

1. Install liboqs: brew install liboqs
2. bundle install
3. bin/rails db:prepare
4. bin/dev
5. http://localhost:3000

Tests

bin/rails test           # Unit and controller tests
bin/rails test:system    # Debugger end-to-end (Selenium + headless Chrome)
bundle exec rubocop
bundle exec brakeman --no-pager

Key endpoints

• GET / — landing page
• GET /quickstart GET /algorithms GET /hybrid GET /security GET /debugger
• POST /verify — accepts { token, pubkey }, runs jwt-pq server-side, returns { valid, algorithm, header, payload } or { valid: false, error }
• GET /samples/:id — returns a freshly signed ML-DSA sample token and its public JWK (for the debugger "Load sample" buttons)
• GET /.well-known/jwks.json — stable public JWKS (ML-DSA-65) for integration testing
• GET /up — Rails health check

JWKS rotation

Keys live on a persistent volume mounted at /rails/storage (see config/deploy.yml). Rotation is manual:

bin/rails jwks:show      # Inspect current kid
bin/rails jwks:rotate    # Generate a fresh ML-DSA-65 key

License

MIT