JWT Security Analyzer
Open Source
JWT Security Analyzer
Features Overview
- JWT Decoder & Encoder: decode tokens to inspect header, payload, and signature; create and sign custom tokens with full algorithm support (HS256/384/512, RS256/384/512, ES256/384/512, PS256/384/512, none).
- Security Analysis: automated vulnerability scanner with 50+ checks covering algorithm weaknesses, insecure claims, signature issues, sensitive data exposure, injection patterns, and RFC compliance — scored on a 0–100 scale.
- Attack Vector Generator: 22 attack payloads including Algorithm None, Algorithm Confusion (RS256→HS256), JWK Injection, Kid Parameter Injection, JKU/X5U hijacking, JWT Smuggling, Nested JWT, Replay, Timing Attack, JWKS Cache Poisoning, plus recent CVEs (CVE-2024-54150, CVE-2024-34273, CVE-2025-20188, CVE-2025-30144).
- Brute Force Tester: dictionary-based HMAC secret cracking with customizable wordlists, real-time progress tracking, speed metrics, and pause/stop controls.
- Network Proxy: HTTP/HTTPS intercepting proxy with automatic JWT detection from headers, cookies, and request bodies; SSL/TLS decryption via auto-generated CA certificates; WebSocket support.
- Token Validator: full signature verification with secret/key input, algorithm validation, claims verification, and expiration checks.
- Replay Attack Simulator: send captured tokens multiple times with configurable delay, method, and replay count; monitors response codes and timing for vulnerability detection.
- HTTP Request Tester: custom request builder (GET/POST/PUT/DELETE/PATCH) with JWT placement options (Authorization header, custom header, query parameter, body) and full response inspection.
- Token Comparison: side-by-side diff of two JWT tokens highlighting header, payload, and signature differences with security impact analysis.
- Key Generator: cryptographically secure HMAC secret generation (8–256 bits) and RSA key pair generation (1024–4096 bits) in PEM format.
- Base64 URL Tools: RFC 4648 Base64 URL encoding and decoding.
- Multi-language support (English/German) with automatic system language detection.