Checks the token's secret against a built-in dictionary automatically. Add your own list for this run only, nothing you upload is kept, and the built-in list stays private.

Edit the header and payload directly, add, change or remove any claim, then sign below. Both boxes need to stay valid JSON.

Signing

HMAC needs a secret, such as one you just cracked. RSA, EC and PSS need a private key. Leaving this unsigned produces a token with no signature at all, matching the header exactly as written above.

Known vulnerabilities