A fast, single-binary CLI for encoding, decoding, cracking, and attacking JWT and JWE tokens.
cargo install jwt-hack
From a quick decode to a full vulnerability scan, every step of JWT and JWE assessment lives in a single fast command.
Recover signing secrets by dictionary or brute force, with hosted wordlist presets and DEFLATE-aware parsing. Parallelised across every core.
Automated checks for the classic JWT vulnerabilities.
Build and inspect JWT and JWE tokens with custom headers and DEFLATE compression.
Check symmetric and asymmetric signatures against a secret or key, with expiry validation.
Generate none-alg, algorithm-confusion, kid injection, and jku / x5u variants in one pass.
Fetch, spoof, verify, and rotate against JWKS key sets to probe key-management weaknesses.
Machine-readable JSON on every command, a REST API server, and an MCP server for AI-driven analysis.
Current token formats and algorithms, kept close to the specifications your targets actually run.
Point jwt-hack scan at a token and it decodes, tries weak secrets, replays attack payloads, and grades every finding by severity. Export the result as JSON or HTML.
none-alg and algorithm confusion--report for the assessmentShips as a single static binary. Install it your way, then decode your first token.
cargo install jwt-hack
brew install jwt-hack
sudo snap install jwt-hack
docker pull ghcr.io/hahwul/jwt-hack
No config, no setup. Pass a token and read it back.
jwt-hack is MIT-licensed and community-driven. Star it, file an attack you want covered, or send a pull request.