Is JWT fuzzing legal?

Only test systems you own or have written authorization to test. Unauthorized security testing may violate laws and terms of service.

What attacks does this simulate?

Tampered payloads, algorithm confusion (alg:none), expired tokens, and invalid signatures — common JWT vulnerability patterns.

Should my API accept alg:none?

Never. Always explicitly specify allowed algorithms in jwt.verify() and reject tokens with alg:none or unexpected algorithms.

JWT fuzzing generates intentionally malformed or tampered tokens — wrong signatures, expired claims, or algorithm confusion — to verify your API rejects them. Use only on systems you own or are authorized to test.

How do I test JWT security in development?

Paste a test token, generate variants, and confirm your API returns 401 for tampered payloads, expired exp, alg:none, and invalid signatures. Pair this with explicit algorithm allowlists in your JWT library.

Tool

JWT Fuzzer

Generate JWT security test variants for development and education.

Last updated July 1, 2026

Runs entirely in your browser — no data sent to servers. Privacy policy

Prove it runs locally

Open DevTools → Network tab
Click Generate
Confirm zero outbound requests for the secret

Generation uses crypto.getRandomValues() in your browser. Privacy policy

Educational use only. Generate test variants for tokens you own. Never probe production systems without authorization — misuse may be illegal.

JWT token

Paste a JWT and click "Generate test variants" to explore common attack patterns for learning.

Paste a JWT token you own (development or test environment only).

Click Generate Test Variants to create tampered versions for security testing.

Use variants to verify your API rejects invalid signatures, expired tokens, and algorithm confusion attacks.

Never use against production systems without authorization.

// Always reject alg:none
jwt.verify(token, secret, { algorithms: ['HS256'] });

// Reject expired tokens
if (payload.exp < Date.now() / 1000) throw new Error('Expired');

// Reject tampered payloads (signature won't match)
jwt.verify(tamperedToken, secret, { algorithms: ['HS256'] });

// Always reject alg:none
jwt.verify(token, secret, { algorithms: ['HS256'] });

// Reject expired tokens
if (payload.exp < Date.now() / 1000) throw new Error('Expired');

// Reject tampered payloads (signature won't match)
jwt.verify(tamperedToken, secret, { algorithms: ['HS256'] });

import jwt
try:
    jwt.decode(token, secret, algorithms=['HS256'])
except jwt.InvalidSignatureError:
    pass  # Expected for tampered tokens
except jwt.ExpiredSignatureError:
    pass  # Expected for expired tokens

token, err := jwt.Parse(tokenString, func(t *jwt.Token) (interface{}, error) {
    if t.Method.Alg() != "HS256" {
        return nil, fmt.Errorf("unexpected alg")
    }
    return []byte(secret), nil
})

How to Use This Tool

Continue learning