Skip to main content

JWTForge

A JWT Vending Service for Testing, Fuzzing, and Security Research of OAuth2/OIDC Implementations.

Read docsSwagger UIDeploy to Cloudflare Workers

Try the token endpoint

Build a request, generate a token, and inspect decoded JWT parts.

Request JSON
Preview
{
  "mode": "fake",
  "header": {
    "alg": "RS256",
    "typ": "JWT",
    "kid": "rsa-key-1"
  },
  "body": {
    "sub": "user123",
    "scope": "openid profile email",
    "roles": [
      "admin",
      "user"
    ]
  }
}
Response
No response yet
Decoded Header
No token yet
Decoded Body
No token yet
Signature
No token yet

Built for OAuth2/OIDC testing

A lightweight JWT token vending service for testing purposes, deployable on Cloudflare Workers. Generate JWT tokens with standard OIDC/OAuth2 and custom claims for development and testing. Use it for fuzzing, end-to-end testing, and penetration testing of OAuth2/OIDC applications and services.

Clone on GitHubDeploy to Cloudflare

Token controls

Generate signed, unsigned, malformed, and literal-signature JWTs using explicit header, body, and signature inputs.

Security modes

Exercise fake, fuzz, malicious, and grammar-driven payloads to test unexpected values, custom claims, and parser behavior.

OIDC workflows

Use OIDC discovery, JWKS, response types, client credentials, introspection, and token exchange in local or CI workflows.