How to use JWTtool safely

Quickstart

Open the workbench, paste a JWT (or use Examples), and wait for local WASM decoding. No account and no network upload.

Recommended workflow

1. Decode — paste a JWT, Bearer header, or token= query value.
2. Review risk — findings are ranked by severity with suggested actions.
3. Attack — start with Recommended, then Mutations for quick edits.
4. Export — copy, diff, or send generated variants from Results.

Attack types

Recommended surfaces contextual presets (expiration, alg:none, kid, privilege claims). Mutations cover fast payload/header edits. Advanced techniques (jku, x5u, confusion) stay collapsed until needed.

Keyboard shortcuts

Ctrl+K

Clear token input

Ctrl+R

Run all attack presets

Ctrl+C

Copy selected generated token

Ctrl+1

Try bundled sample token

Privacy model

Parsing, analysis, mutation, signing helpers, and Base64url utilities run in the browser. Avoid using production secrets unless you understand the local threat model of your machine and browser session.

Troubleshooting

• WASM stuck loading — use Retry on the loader or hard-refresh the page.
• Parse error — ensure the token has three Base64url segments (header.payload.signature).
• Share links — full tokens use URL hash; sample scenarios use ?demo= for short links.

Responsible use

Only test systems you own or are explicitly authorized to assess. Generated tokens and request helpers are offensive testing utilities, not authorization bypass permission.