$loading...
PortSwigger Web Security Academy is the best free resource for learning web application security. Payload Playground is where you execute what you learn —25 generators, 39 tools, and a CLI for crafting payloads instantly, without needing Burp Suite running. Most learners use both.
Web Security Academy wins at
Payload Playground wins at
| Feature | Payload Playground | Web Security Academy |
|---|---|---|
| Price | Free | Free |
| Purpose | Payload generation & execution | Learning & education |
| Zero install — runs in browser | ||
| JWT attack templates | 15+ templates (alg:none, key confusion, etc.) | JWT Editor extension for Burp |
| Payload generators (XSS, SQLi, SSTI, SSRF...) | 25 interactive generators | Examples in lab descriptions |
| Encoding pipeline | 286 operations with chaining | |
| WAF bypass tools | 8 WAF profiles + payload mutator | |
| SQL injection payloads | Interactive generator + enumeration wizard | Lab exercises |
| SSRF payloads | Generator with IP encoding tricks | Lab exercises |
| Structured learning paths | ||
| Hands-on lab environment | ||
| Detailed vulnerability explanations | Blog + guides | Comprehensive theory articles |
| CLI tool | npm install -g payload-playground | |
| Cheat sheets | 22 copy-ready cheat sheets | |
| Certifications (BSCP) |
Use these alongside the Academy — they generate the payloads the labs teach you to craft.
JWT Decoder & Attacker
15+ attack templates. Covers all Academy JWT labs: alg:none, key confusion, JWKS spoofing.
Encoding Pipeline
286 chained operations for encoding labs. Build recipes for any transform chain.
SSRF Generator
Cloud metadata payloads, IP encoding tricks, and protocol wrappers for SSRF labs.
SQL Injection Generator
UNION-based, blind, and time-based SQLi for MySQL, PostgreSQL, Oracle, and MSSQL.
CORS Misconfiguration Generator
PoC payloads for reflected origin, trusted subdomain, and null origin bypass.
WAF Bypass Transformer
Auto-generate evasion variants for XSS, SQLi, and CMDi across 8 WAF profiles.
SSTI Generator
Template injection payloads for Jinja2, Twig, Freemarker, Smarty, and Velocity.
Reverse Shell Generator
30+ shell types for post-exploitation labs. Includes listener commands and stabilization.
Is Payload Playground a replacement for PortSwigger Web Security Academy?
No — they serve very different purposes and work best together. PortSwigger Web Security Academy is an educational platform for learning web vulnerabilities through structured reading and hands-on labs. Payload Playground is a payload generation toolkit for use during actual engagements and CTF challenges. Use the Academy to learn a technique; use Payload Playground to craft the payloads when you are executing it.
What tools does Payload Playground provide for Web Security Academy labs?
Payload Playground has tools that directly complement Web Security Academy labs: the JWT Decoder with 15+ attack templates covers all JWT labs (alg:none, key confusion, weak secrets, JWKS spoofing); the SSRF Generator covers SSRF labs with IP encoding tricks and cloud metadata payloads; the CORS Misconfiguration Generator covers CORS labs; the Encoding Pipeline with 286 operations helps with encoding-based labs; and the SQL Injection Generator covers every major SQLi technique taught in the Academy. All run in your browser alongside the Academy.
How does Payload Playground compare to PortSwigger for JWT attacks?
PortSwigger teaches JWT attack theory in detail and provides the JWT Editor Burp extension for testing. Payload Playground's JWT Decoder and Attacker provides 15+ attack templates (alg:none, key confusion, weak secret brute force, embedded JWK, kid injection, JWKS spoofing), an interactive fuzz tab, RSA key generation, JWKS endpoint generation, and a CLI command — all without needing Burp Suite installed. For learners following the Academy's JWT labs, PP can generate the attack payloads in seconds.
Can I use Payload Playground without Burp Suite for Web Security Academy?
Yes for payload generation and encoding tasks. Some Academy labs require Burp Suite as an intercepting proxy (e.g., HTTP request smuggling labs that need you to intercept and modify live traffic). However, Payload Playground handles the payload crafting side without Burp: encoding chains, JWT attacks, XSS payloads, SQLi payloads, SSRF payloads, SSTI payloads, and WAF bypass transformations. Many learners keep PP open alongside the Academy and Burp for the fastest workflow.
Learn the technique in the Academy. Generate the payload here. No install, no friction.
JWT Decoder & Attacker
15+ attack templates for JWT labs
Encoding Pipeline
286 operations — encoding lab companion
SSRF Generator
Cloud metadata, IP encoding tricks
SQL Injection Generator
UNION-based, blind, time-based payloads
All 25 Generators
XSS, SQLi, SSTI, SSRF, shells & more
26 Cheat Sheets
Copy-ready payloads for every category