Mini-game · Chapter 3

JWT Cracker Race

Three tokens, each signed with HS256 by a server that picked a weak secret. Run a real wordlist brute force in your browser using the Web Crypto API and see how long each one takes.

Educational training material. This game demonstrates an attack technique inside a sandboxed quiz UI for security learning. Do not apply these techniques against systems you do not own or have explicit written permission to test.

Token 1 / 3 Score 0 Time 00:00