JWT Attack Simulator

Paste a JWT and simulate alg=none, weak-secret brute force, and kid header injection attacks. See exactly what an attacker could forge.

Free

Token input

Tokens are processed in-memory and discarded after the response is returned.

Paste a JWT and run a simulation to see exploit outcomes.

Session Cookie Analyzer

Audit Set-Cookie headers for security flags.

CORS Misconfiguration Tester

Probe a target for permissive CORS policies.

OAuth / OIDC Flow Debugger

Flag misconfigurations in OAuth flows.