JWT Debugger · Local

Runs 100% offline · No data leaves your browser

Encoded — paste a JWT here

Input — editable
Generated / parsed — color-coded

Decoded

Header 
{}
Payload 
{}
Verify Signature
!Enter a token to verify
Editing the Header or Payload JSON above and clicking Re-sign produces a new token in the Encoded box.

Attacks & Pentest Tools — for authorized testing only

Use these against systems you are explicitly authorized to test. All operations run locally in your browser.

alg: none — signature bypass

Forges a token with the current header/payload and no signature. Tests servers that fail to reject unsigned tokens (CVE-class auth bypass).

Algorithm confusion — RS256 → HS256

Re-signs the token as HS256 using the RSA public key as the HMAC secret. Exploits servers that use one verify() call with the wrong key type.

needs Public Key (PEM) above

Weak secret brute-force (HS*)

Tries a wordlist against the current HMAC token to recover a weak signing secret. One entry per line; built-in common list included.

kid header injection

Injects a payload into the kid header to probe SQLi, path traversal, or command injection in key lookups, then re-sign above.

Claim tampering

Quick edits to the payload for privilege-escalation and expiry tests. Modifies the Decoded payload — then Re-sign.

Utilities

Convert a JWK public key to PEM (for the verify field) and translate epoch timestamps to your local time.