Decode, edit, and re-sign JSON Web Tokens, and probe for the classic weaknesses —alg:none, weak HMAC secrets, and missing expiry. All processing happens locally in your browser.

Encoded token

Header

Payload

Re-sign / forge

HMAC secret (for HS256/384/512)

Editing the header's alg changes the signing algorithm. Only HMAC (HS*) signing is supported client-side; asymmetric algorithms decode/verify-decode only.

Result token

samit_hota

Security research, offensive engineering, and strategic advisory for teams who treat security as a competitive advantage, not a checkbox.

[email protected]

GitHub LinkedIn X / Twitter Medium Instagram Facebook

Navigate

Consulting
Privacy Policy
Terms of Service

Tools

All Tools
Vulnerability Scanner
WAF Checker
CVE Explorer
Typosquat Radar

Resources

Research
Advisories
Security News
Adversaries
IOCs

Feeds

Blog RSS
Advisories RSS
Security News RSS

Live