Local execution
JWT parsing, analysis, mutation, signing helpers, and encoding utilities run in your browser through WebAssembly.
Trust & privacy
Designed for local JWT security testing
JWTtool is built to reduce exposure while you inspect and mutate tokens. The browser is the execution boundary; your operational policy still decides which tokens are safe to paste.
- WASM in-browser
- No upload
- Local-first
No token upload
The app does not need a backend to inspect tokens. Treat production tokens as sensitive local data and avoid sharing generated URLs.
Private deployment
The public interface avoids linking to private repository resources. Internal teams can review source and issues through their usual private channels.
Authorized testing only
Generated variants are offensive security utilities. Only test systems you own or are explicitly authorized to assess.
Privacy model
Tokens may be stored in local browser history for convenience and can appear in URL hashes when you use share links. Use sample scenario links for clean sharing, and avoid pasting production credentials on shared machines.