authlab — opening
Loading
This started as ContactWise — a real auth platform I built and deployed with email verification, JWT sessions, and an admin area. Asking people to sign up on a stranger's demo site to see it was a terrible pitch. So I rebuilt the whole thing as a simulation: same flows, same failure modes, running entirely in your browser.
The original ran these five steps on a live server with a real database and real email delivery. The simulation keeps the logic and drops the infrastructure — nothing here needs a cold start.
The lab
What I'd try first: sign up with a made-up email and watch it land in the mailbox. Try signing in before verifying — it'll refuse. Then borrow the admin credentials and go delete someone.
No session yet. Sign in and take the token apart — header, payload, signature, the lot.
Nothing yet. Sign someone up — the verification email lands right here, just like a real inbox.
Locked — this panel reads the role claim off your token. Dana can't get in here. The admin demo account can.
Quiet so far. Every decision ends up here — the embarrassing failures especially.
Field notes
The user store only ever sees a hash — exactly how production systems do it. The admin table shows the hash on purpose: it's the difference between a leaked database being annoying and being catastrophic.
The payload is standard base64url — paste it into jwt.io and it reads fine. That's the part people miss about JWTs: they're signed, not encrypted. Never put a secret in one.
Absurdly short for production, perfect for a demo. Nobody's going to wait an hour to see a session die — and watching the exp claim actually kill your login teaches more than any diagram of refresh tokens.
It answers the same whether the account exists or not — exactly how production systems prevent enumeration. The 'helpful' version — “no account found for this email” — hands an attacker your user list one address at a time.
Unverified accounts exist but can't sign in, and the emailed token works exactly once. Any signup flow without this is an open door with a welcome mat.
Getting told no by the admin panel logs a 403 event, same as a success. If someone is probing surfaces they shouldn't reach, that should show up somewhere a human looks.
The lab simulates exactly what happens in a real deployment — the same flows, the same failure modes, the same authorization rules. Hashing, signing, and email delivery run as in-browser models, so you can watch every step of a production auth system without standing up a server.
Built by Abhishek Suman
Backend-minded engineering with interfaces that make complex systems easier to reason about.