{
  "numerator": 254,
  "denominator": 656,
  "percent": 38.71951219512195,
  "counting_rule": "Regex words \\b[\\w]+(?:[’'-][\\w]+)*\\b. Denominator includes all article paragraphs/headings plus static inspector labels, instructions and status. Excludes measured table, code, downloads/navigation/footer and diagram labels. Numerator only five paragraphs whose numerical paired controls are supported by this fresh batch. Common decode/verify guidance excluded.",
  "comparison_scope": "Ten related page bodies retrieved2026-11-03 and indexed in comparison-inventory.json; these are not a verified Google natural top ten. The quantitative four-fixture experiment is absent from the retrieved text; no whole-web absence or untested UI feature claim.",
  "old_experiment_reused": false,
  "paragraphs": [
    {
      "id": "answer",
      "exclusive": false,
      "words": 37,
      "text": "Paste a signed JWT to read its header and payload while keeping the original payload bytes visible. The inspector below decodes Base64URL; it does not verify the signature. Identical readable claims do not establish identical signing input.",
      "evidence": "common/method/limitations; excluded"
    },
    {
      "id": "method",
      "exclusive": false,
      "words": 41,
      "text": "Measured November 3, 2026 using Python 3.12.14 and Node v24.19.0. Four newly constructed, nonsecret HS256 tokens were checked with Python hmac and Node crypto. These are local byte and HMAC comparisons, not online-tool, browser-compatibility or production-authentication tests.",
      "evidence": "common/method/limitations; excluded"
    },
    {
      "id": "bytes",
      "exclusive": true,
      "words": 47,
      "text": "The escaped fixture contained 38 payload bytes and a 132-character token. Its literal UTF-8 counterpart contained 34 payload bytes and a 127-character token. Python and Node decoded both to the same two claims, including the name Café, but recorded different payload SHA-256 values and different HMAC signatures.",
      "evidence": "new-local-results.json plus fixtures/manifest.json and independently executed verify-node.cjs"
    },
    {
      "id": "spaces",
      "exclusive": true,
      "words": 49,
      "text": "Adding spaces without changing either claim produced a 43-byte payload and a 139-character token. Its signing input grew to 95 bytes, compared with 88 for the escaped fixture and 83 for the UTF-8 fixture. Both runtimes accepted the freshly calculated HMAC for each of these three independently signed controls.",
      "evidence": "new-local-results.json plus fixtures/manifest.json and independently executed verify-node.cjs"
    },
    {
      "id": "negative",
      "exclusive": true,
      "words": 49,
      "text": "The negative control reused the escaped fixture’s signature with the UTF-8 fixture’s encoded payload. It remained 127 characters long and decoded to the same claims as the valid UTF-8 control. Its HMAC check failed in Python and Node, although its 34 decoded payload bytes matched that valid control exactly.",
      "evidence": "new-local-results.json plus fixtures/manifest.json and independently executed verify-node.cjs"
    },
    {
      "id": "hashes",
      "exclusive": true,
      "words": 48,
      "text": "The escaped, UTF-8 and spaced payloads had three different SHA-256 values in the saved report. The valid UTF-8 token and its old-signature control shared one payload checksum, but only the newly signed token passed the HMAC check. Payload equality alone therefore did not distinguish those two measured controls.",
      "evidence": "new-local-results.json plus fixtures/manifest.json and independently executed verify-node.cjs"
    },
    {
      "id": "normalized",
      "exclusive": true,
      "words": 61,
      "text": "A second local control reserialized all three valid claim objects while keeping each original signature. Compact UTF-8 produced the same 34 payload bytes each time, but only the original UTF-8 signature still matched. Pretty UTF-8 produced the same 43-byte payload each time and none of the three retained signatures matched. This was deliberate payload replacement, not a failure to read JSON.",
      "evidence": "new-local-results.json plus fixtures/manifest.json and independently executed verify-node.cjs"
    },
    {
      "id": "interpret",
      "exclusive": false,
      "words": 49,
      "text": "The general distinction between decoding and signature verification is not new. This comparison adds the downloadable byte representations, exact lengths and paired HMAC outcomes. Inspect the original encoded segments when investigating a mismatch; formatting the decoded JSON is a display operation, not a replacement for the original signed bytes.",
      "evidence": "common/method/limitations; excluded"
    },
    {
      "id": "question",
      "exclusive": false,
      "words": 52,
      "text": "Why can the same displayed JSON accompany a failed signature check? In this controlled example, the displayed claims hide differences in the serialized payload or in the signature paired with it. Read the raw payload alongside the formatted view, then verify the original token with the correct key and trusted validation rules.",
      "evidence": "common/method/limitations; excluded"
    },
    {
      "id": "reproduce",
      "exclusive": false,
      "words": 47,
      "text": "Download the reproduction script and run it with Python and Node installed. It creates the four synthetic tokens, records Python results, runs the Node comparison and checks agreement. The public test key is included to make the fixture reproducible; it is not a credential for any service.",
      "evidence": "common/method/limitations; excluded"
    },
    {
      "id": "limits",
      "exclusive": false,
      "words": 49,
      "text": "The experiment checks HMAC-SHA256 with one public test key. It does not validate issuer, audience, expiration, nonce or an application session. A matching HMAC does not by itself make a token acceptable to an application. The page’s interactive inspector performs decoding only and never reports a signature as verified.",
      "evidence": "common/method/limitations; excluded"
    },
    {
      "id": "related",
      "exclusive": false,
      "words": 42,
      "text": "Use the Base64URL decoder for an individual encoded segment and JSON escape for the representation of JSON strings. The earlier duplicate-key experiment concerns competing member names; this page holds the claim names and values constant while comparing original serialization and signature pairing.",
      "evidence": "common/method/limitations; excluded"
    }
  ]
}