JWT Forge & Verify Simulator

1 · Craft a token (the attacker controls header & payload)

Pick an attack. Remember: the header and payload are just base64url — anyone can read and rewrite them. Only correct server-side verification stops a forged token.

Attack / token

Token (header.payload.signature)

Decoded header

Decoded payload (readable by anyone)

2 · Configure the server's verifier

Pin algorithm to HS256 (reject none & others) If off, the server trusts the alg in the token header. Verify the signature If off, any tampered payload is accepted. Use a strong, random HMAC secret If off, the server uses the weak secret 'secret'. Validate exp (expiry) If off, expired tokens are accepted (replay).