Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

Cookie / JWT Auditor

Web Security Audit Free · No sign-up

Attack-focused audit of cookie flags and JWTs - alg-confusion, jku/kid injection, prefix & SameSite gaps - fully in your browser.

Try it now No sign-up required. Runs entirely in your browser.

100% client-side - cookies never leave your browser. Flags Secure / HttpOnly / SameSite, __Host-/__Secure- prefix compliance, broad Domain scope and CSRF/XSS exposure.

What is Cookie / JWT Auditor?

Cookie / JWT Auditor inspects the security posture of cookies and JSON Web Tokens you paste in, from an attacker’s point of view. For cookies it checks the protective attributes and the things bug-bounty reports actually hinge on - __Host-/__Secure- prefix compliance, over-broad Domain scope and SameSite/CSRF exposure.

For JWTs it decodes the header and payload and then audits for real attack paths: alg=none, HMAC/RSA alg-confusion, jku/jwk/x5u/kid header injection (SSRF, key-forgery, path-traversal/SQLi), missing or excessive expiry, and privilege/sensitive claims worth tampering with - each with the exact thing to test next.

It also doubles as a live JWT editor / forge: edit the header or payload and the token rebuilds instantly. Choose a signature mode - keep the original (to test whether the server even verifies), force alg=none, or re-sign with an HMAC secret (real HS256/384/512 in-browser, ideal once you have a cracked/guessed key) - then copy the forged token straight into your request.

Everything runs client-side, so the cookies and tokens you analyze never leave your browser - safe for live session data.

What it flags

  • Cookie flags - Secure, HttpOnly and SameSite, with session-cookie-aware severity.
  • Cookie scope - __Host-/__Secure- prefix compliance and over-broad Domain sharing.
  • JWT algorithm attacks - alg=none, HMAC↔RSA alg-confusion and unsigned tokens.
  • JWT header injection - jku/jwk/x5u (SSRF/key-forgery) and kid (path-traversal/SQLi).
  • JWT claims - expiry gaps/long lifetimes plus privilege and sensitive-data claims.
  • Decoded header & payload + claims table, with next-step pivots (Hash Cracker, SSRF Toolkit).

Where it fits in your workflow

  • →Assess session-cookie hardening and CSRF exposure during a web test.
  • →Triage a captured JWT for forge/confusion/injection paths before attacking it.
Want more?

This one is free in your browser. Sign up for server-side recon, scan history, and projects.

Create free account Sign in

At a glance

CategoryWeb Security Audit
RunsIn your browser
Token cost Free - no tokens
Access No login needed
Status● Live

Frequently asked questions

Why a separate JWT Decoder tool?

The JWT Decoder is a quick pretty-printer. This auditor focuses on offensive findings - alg-confusion, jku/kid injection, prefix gaps and privilege claims - and points you to the next attack.

Can it crack a JWT secret?

It flags HS-algorithm tokens as brute-forceable and links to the Hash Cracker for offline wordlist attacks; the Vulnerability Scanner also includes a server-side HS256 check.

Other free tools you might like

Test Data Generator

Realistic-looking test data across 22 countries: names, emails, phone numbers (fiction-reserved ranges), addresses, postal codes and format-valid sample IDs. Safety-reserved ranges so values look real but never collide with live data. Cards, text, JSON and CSV export.
Hash Toolkit

Generate (MD5, NTLM, SHA) and identify 60+ hash types with ranked candidates. Builds tailored hashcat and John commands (wordlist, rules, mask), with file-extraction helpers and crack-speed guidance. Fully client-side.
Text Suite

7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-drop line filter, set operations (A−B, ∩, ∪), URL-parts extraction, case conversion (camel, snake, kebab and more), per-line transforms, secret extraction and stats. Per-tab undo (10 steps), drag-drop import.
Explore more tools →