Browser-based JWT/JWS forgery lab — HS256, RS256, ES256, and alg:none side by side, with real WebCrypto signing, a verifier-policy panel that flips between correct and vulnerable, and alg:none and HS/RS key-confusion forgeries that the vulnerable verifier accepts and the correct one rejects
jwt cryptography rsa ecdsa hmac application-security jws json-web-token appsec webcrypto signature-verification jwt-security crypto-lab jwt-attacks alg-none key-confusion token-tampering
-
Updated
Oct 12, 2026 - TypeScript