About JWT Arsenal
A toolkit built out of frustration - tired of copy-pasting Python scripts and switching between five different tabs during a JWT pentest. Everything you need, directly in the browser, no setup required.
Why this project exists
JWT vulnerabilities are everywhere - misconfigurations in algorithm handling, key injection, unsigned token acceptance. They show up in bug bounty programs, CTF challenges, and real-world pentests constantly. Yet every time, the workflow is the same: open jwt.io to decode, switch to a Python script to forge, paste the token into Burp, repeat.
JWT Arsenal was built to collapse that entire workflow into one place. You paste a token, tweak the payload, pick an attack, and get a forged token - all without leaving the tab, without installing anything, and without sending your client's tokens to a third-party server.
The Knowledge Base exists because understanding why an attack works matters as much as executing it. Each article covers the cryptographic mechanics, the RFC that defines the behaviour, and the vulnerable code pattern - so you can identify the flaw yourself, not just press a button.
Privacy & security model
This is a static site. There is no server, no API, no database. The entire application is HTML, CSS, and JavaScript served from a CDN. All cryptographic operations run locally via the browser's native Web Crypto API .
You can safely paste real tokens from live engagements. Nothing is logged, cached, or stored anywhere outside of your browser's local memory.
Open source & contributions
JWT Arsenal is fully open source under the MIT license. The code is on GitHub - readable, forkable, improvable. If you spot a bug, want to add a new attack module, or want to contribute a Knowledge Base article, pull requests are welcome.
Tech stack
Research & references
- PortSwigger Web Security Academy — JWT attacks
- Tim McLean (2015) — Critical vulnerabilities in JWT libraries
- PortSwigger Research — Bleichenbacher-style RSA key recovery
- silentsignal — rsa_sign2n public key recovery tool
- RFC 7515 — JSON Web Signature (JWS)
- RFC 7517 — JSON Web Key (JWK)
- RFC 7518 — JSON Web Algorithms (JWA)
- RFC 7519 — JSON Web Token (JWT)
- OWASP JWT Security Cheat Sheet
JWT Arsenal is intended exclusively for authorized penetration tests, bug bounty programs (within scope), CTF competitions, and security research in lab environments you own.
Using this tool against systems without explicit written authorization is illegal under the CFAA, the Computer Misuse Act, and equivalent laws worldwide. The author accepts no liability for misuse.