json-web-tokens
VampSecure Labs JWT Security Auditor — token decoder, alg=none, RS256→HS256, HMAC brute force