Account

Signed in as guest · role user · uid 0 · exp none · verified via None

Your session token, decoded

header

(no session cookie set — sign in first)

payload

(no session cookie set — sign in first)

Decode first. The header alg is the whole game. Try each in turn: does the verifier honour alg:none? Is the HS256 key weak enough to crack? Does a kid header get read off disk? And separately — does tampering with the payload even get rejected on every route?

Handy links (some are meant to be found, not linked)

Email me a magic sign-in link · My orders (API) · Secure vault (2FA) · Partner SSO callback · Log out

Published key material: /.well-known/jwks.json and /keys/public.pem. Ask yourself why a service that only ever verifies RS256 would let you pick the algorithm.