JWT Token

Header

Payload

Signature

Security Analysis

⚔️ JWT Attack Platform

Guided attack generation for comprehensive JWT security testing

Select Attack Category

Algorithm Attacks

🚫

None Algorithm Bypass

Remove signature verification by setting algorithm to "none"

Easy High Impact

Learn Attack

🔄

Algorithm Confusion

Convert asymmetric algorithms (RS256/RS384/RS512) to symmetric (HS256/HS384/HS512) using public key as HMAC secret

Medium High Impact

Master Technique PortSwigger Lab

Header Injection Attacks

💉

Kid Parameter Injection

SQL injection, path traversal, command injection via kid parameter

Medium High Impact

Injection Guide Practice Lab

🌐

JKU/X5U Manipulation

URL manipulation attacks for key injection and SSRF

Hard Critical

Attack Guide Vuln Details

🔑

JWK Header Injection

Embed malicious public key directly in JWT header

Medium Critical

Key Injection Solve Lab

Payload Manipulation

⬆️

Privilege Escalation

Role and permission bypass through payload manipulation

Medium Critical

Escalation Methods Claims Guide

🎭

Claim Spoofing

Manipulate user identity and authorization claims

Easy High Impact

Claims Guide Claims Basics

Configure Attack

Generated Attack Payloads

JWT Token for Bruteforce

Bruteforce Method

JWT Secrets List Custom Wordlist

Using the default jwt secrets list file containing common JWT secrets and passwords.

Results

Ready to start

JWT Token to Edit

Header

Payload

Signature Options

Algorithm:

Secret Key:

Private Key (for signing):

Generated JWT

Verify Signature

Secret Key:

Header

Payload

Add Common Claims:

Signature Options

Algorithm:

Secret Key:

Private Key (RSA/PEM format):

💡 Click to generate a new RSA-2048 key pair for testing