JWT

JWT Forge forge · decode · attack

● Header HS256

● Payload

● Claims

● Signature

Force empty signature (strip signature regardless of alg)

Attack Presets

kid:/dev/null — Sets "kid": "../../../dev/null" in the header and signs with an empty string secret. The server reads /dev/null (0 bytes) as the key, so HMAC verification passes.
alg:none — Classic unsigned token bypass.
Empty key — Signs with "" as the HMAC secret.

Encoded Token

Token Anatomy

■ Header ■ Payload ■ Signature

Waiting for input

⚡ Attack Tokens