JWT Attack Tool

JSON Web Tokens are only as secure as the code that verifies them, and several well-known implementation flaws keep showing up in real applications. This tool helps security researchers and developers test for those flaws against their own systems: paste a token and apply attack vectors like setting alg to none, flipping RS256 to HS256 (algorithm confusion), injecting a path-traversal kid value, embedding an attacker-controlled JWK, stripping the signature entirely, or tampering with claims like admin and role.

Each attack vector shows the decoded header and payload of the modified token side by side, along with a plain-language explanation of what the attack does and why a vulnerable server might accept it.

Responsible use

This tool is intended strictly for authorized penetration testing, security research, and education — only test tokens and systems you own or have explicit permission to assess.