• JWT Workbench

  jwt.bntl.ee

  Decode, verify, sign and tamper with JWTs and SD-JWTs. Claim catalogue, algorithm confusion and weak-secret checks. Nothing leaves the page.

• CyberChef

  cyberchef.bntl.ee

  The upstream GCHQ release, v11.4.0. Encoding, encryption, compression, parsing and data analysis, composed as recipes in the browser.

Both tools run entirely in your browser and are served as static files. They are kept on separate hostnames from bntl.ee, which is an intentionally vulnerable test site, so that nothing hosted there can script or read them.