Examples
Choose a scenario to test Each card describes a real-world JWT problem, what you will learn, and opens a safe sample token in the workbench — without pasting long strings yourself.
WASM in-browser No upload Local-first Start testing Expiration · HMAC Beginner Generic API / Auth0-style
Expired HS256 session Problem: Token still parses but exp is in the past — common in stale sessions and refresh bugs.
You will test: See expiration findings, extend exp, try HMAC crack and privilege mutations.
eyJhbGciOiJI…….••••••••…adQssw5c Reveal Copy
Risk analysis Extend expiration Promote to admin Crack HMAC secret
Expected findings Expired token Privilege claim Missing issuer/audience Try sample token Algorithm bypass Beginner Legacy APIs
Unsigned alg:none token Problem: Algorithm none accepts empty signature — classic JWT bypass when verification is weak.
You will test: Inspect unsigned state, generate alg:none variants, edit payload claims.
eyJhbGciOiJu…….••••••••… Reveal Copy
Unsigned signature alg:none variants Payload editing
Expected findings Unsigned algorithm Admin role claim Empty signature Try sample token Privilege claims Intermediate Auth0 / custom APIs
Auth0-style role escalation Problem: Application authorization often depends on role-like claims embedded directly in the token.
You will test: Validate how JWTtool highlights privilege claims and generates admin-oriented mutations.
eyJhbGciOiJI…….••••••••…adQssw5c Reveal Copy
Role detection Admin mutation Diff review
Expected findings Privilege claim Symmetric algorithm Missing audience Try sample token Session expiry Beginner AWS Cognito-style
Cognito stale session review Problem: Expired access tokens are a common source of confusing auth failures and weak refresh handling.
You will test: Review expiration risk, extend exp for authorized testing, and compare the generated token.
eyJhbGciOiJI…….••••••••…adQssw5c Reveal Copy
Expiration review Extend exp Copy test token
Expected findings Expired token Moderate risk score Extend expiration action Try sample token Issuer / audience Advanced CI/CD OIDC
GitHub OIDC trust boundary Problem: OIDC tokens often carry repository, workflow, and subject claims that must be validated exactly.
You will test: Use the viewer and risk panel to inspect claims before testing policy assumptions.
eyJhbGciOiJI…….••••••••…adQssw5c Reveal Copy
Issuer/audience review Subject tamper Export variants
Expected findings Missing issuer Missing audience Tamper presets Try sample token Custom claims Intermediate Firebase-style
Firebase custom admin claim Problem: Custom claims can accidentally become authorization switches when server checks are too loose.
You will test: Practice identifying and mutating privilege-bearing claims before comparing the output.
eyJhbGciOiJu…….••••••••… Reveal Copy
Admin claim review alg:none variants Payload editing
Expected findings Unsigned algorithm Admin role Payload editable Try sample token