PAGES
← all tools
◆ Web Application Security

jwt-hack

v2.6.0 open-source

jwt-hack is a high-performance toolkit for testing, analyzing, and attacking JSON Web Tokens.

source ↗ rss ↗ What is a cyber toolchain?

Summary

jwt-hack is an open-source command-line toolkit, written in Rust, for testing, analyzing and attacking JSON Web Tokens, distributed free via Cargo, Homebrew, Snapcraft or Docker. It covers the lifecycle a pentester needs when a target uses JWTsJWTsJSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage.: encoding and decoding tokens (including JWE, with DEFLATE compression and custom headers), verifying signatures against a secret or key, and cracking secrets via dictionary or brute-force attack using all available CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores. This makes it a fit for penetration testers and application security engineers probing authentication tokens rather than for developers building JWT support into an app. It sits in the web-app-security space alongside other JWT-focused attack utilities, distinguished by bundling encode, decode, verify and crack into one binary instead of separate scripts. Development is active, with 288 commits and 11 releases in the past year across 17 contributors since its 2020 first commit.

jwt-hack is a high-performance toolkit for testing, analyzing, and attacking JSON Web Tokens.

How jwt-hack helps

Is a token I intercepted actually signed, or is it exploiting an "alg":"none" bypass?

decodes the header and payload and reports the algorithm and key state explicitly, flagging an unsigned token with an empty signature segment rather than silently treating it as valid

Can I forge a working token if I've guessed or found the signing secret?

encodes a new token with that secret under the chosen algorithm and returns the full compact token string, so the forged token can be replayed straight at the target

How weak is this application's JWT secret?

runs a dictionary or brute-force attack across all CPU cores against the captured token and reports whether a matching secret was found

Did the developers hide anything inside a compressed claims payload?

decodes the JWE structure and inflates DEFLATE-compressed segments, exposing header fields like key management and encryption algorithm even when the ciphertext itself can't be decrypted without the key

Will this token still be accepted after its issued-at or expiry claims are checked?

decodes the payload and surfaces the issued-at timestamp in human-readable form so a tester can see whether expiration validation would catch a replayed or stale token

Does this endpoint accept tokens signed with asymmetric keys I can supply myself?

verifies a token against a supplied private or public key file for RSA/ECDSA algorithms, confirming whether key-based verification succeeds or fails

all 16 features, with the evidence for each →

Languages

Not documented

Features

16 capabilities · 9 backed by code, an API document or a real run

Built from jwt-hack's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • jwt-hack covers 1 of the 8 vulnerability assessment methods capabilities we track.

What jwt-hack offers you

  • Command-line interface5
All capabilities 16 capabilities
JWT encoding and signing verified Encodes a payload into a signed JWT using HMAC (HS256) or the 'none' algorithm, masking secrets in output and printing the full compact-serialized token. 6 other sources · first seen Aug 2026

we ran it

  • Produced a signed JWT using HS256; the secret is masked in the output as asterisks. Aug 2026 · the full run
  • The tool output a JWT with header eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0 and payload eyJ0ZXN0IjoicGF5bG9hZCJ9, with an empty signature segment. Aug 2026 · the full run
  • The tool output a JWT with algorithm set to none and no key, producing the token eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjM0IiwibmFtZSI6IkpvaG4gRG9lIn0. with an empty signature segment. Aug 2026 · the full run
  • Output a single HS256-signed JWT token: …. Aug 2026 · the full run
  • The tool produced a signed JWT using algorithm HS256, masking the key in output, and returned the full token string. Exit status 0 confirms successful encoding. Aug 2026 · the full run

example

  • Encode JWT with secret jwt-hack encode '{"sub":"1234"}' --secret=your-secret
JWT vulnerability scanning shipped Performs automated vulnerability scans on JWTs, including detection of SQL injection vectors within claims. 3 releases · 3 other sources · first seen Jun 2025

Shared capability: Web vulnerability scanning

Also counts toward: Command-line interface

release

  • New jwks subcommand fetches, spoofs (via jku/x5u), verifies tokens against a JWKS endpoint, and tests for key-rotation vulnerabilities v2.6.0 · Jun 2026 · source · release history
  • Adds jwt-hack scan subcommand to perform JWT vulnerability scanning v2.4.0 · Oct 2025 · source · release history
  • New SQL Injection detection module that tests JWT claims for SQLi attack vectors v2.0.0 · Jun 2025 · source · release history

docs

  • Toolkit for testing, analyzing, and attacking JSON Web Tokens via decode, encode, verify, crack, payload generation, and vulnerability scanning.

example

  • Fetch and verify a token against a remote JWKS to check for key rotation issues jwt-hack jwks --url https://example.com/.well-known/jwks.json --token <encoded_token> v2.6.0 · Jun 2026 · source
  • Scan JWT for vulnerabilities jwt-hack scan JWT_TOKEN
Wordlist-based secret cracking verified Attempts to recover HMAC signing secrets by testing candidates from a user-supplied wordlist file, with optional use of all available CPU cores for parallel processing. 2 releases · 4 other sources · first seen Jun 2025

Also counts toward: Command-line interface

release

  • Adds --preset flag to crack mode for selecting character set presets, enabling faster brute-force without manually specifying character sets. v2.3.0 · Sep 2025 · source · release history
  • crack subcommand now supports cracking JSON Web Tokens using RSASSA-PSS (PS) and ECDSA (ES) signature algorithms v2.0.0 · Jun 2025 · source · release history

command line

example

  • Dictionary attack on JWT jwt-hack crack -w wordlist.txt JWT_TOKEN
  • Brute force crack JWT jwt-hack crack -m brute JWT_TOKEN --max=4
Payload compression verified Applies DEFLATE compression to the JWT payload before signing, recording the compression method in the 'zip' header field. 1 release · 4 other sources · first seen Aug 2025

release

  • Add JWT compression support with zip: DEF header for DEFLATE compression v2.1.0 · Aug 2025 · source · release history

we ran it

  • The tool produced a HS256-signed JWT with the zip header set to DEF, indicating the payload was compressed before signing. Aug 2026 · the full run
  • The tool produced a signed JWT using HS256, with the secret redacted as asterisks in the output. Aug 2026 · the full run
  • The tool produced a signed JWT using HS256 with the zip header set to DEF, indicating compression was applied. The full token is printed and the exit status 0 confirms successful encoding. Aug 2026 · the full run

example

  • Handle a JWT that has been compressed using the DEFLATE algorithm via the zip header. jwt-hack decode jwt_token_with_deflate.zip --zip v2.1.0 · Aug 2025 · source
JWT decoding verified Parses and displays the header, algorithm, and payload fields of a compact-serialized JWT, rendering timestamps in human-readable UTC format. 1 release · 3 other sources · first seen Oct 2021

release

  • Adds --jku and --x5u payload types to bypass type-based filtering in JWT analysis. v1.1.0 · Oct 2021 · source · release history

we ran it

  • The tool rejected the input immediately, reporting that the token format was unrecognised — it expected either 3 parts (JWT) or 5 parts (JWE) but received only 1 part. Aug 2026 · the full run
  • The tool successfully decoded the token (exit 0), showing algorithm HS256, type JWT, and a payload containing subject 1234567890, name John Doe, and an issued-at timestamp of 1516239022, rendered… Aug 2026 · the full run

example

  • Decode a JWT token jwt-hack decode eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0In0.CHANGED
Verbose output verified Displays detailed progress information during tool execution when the verbose flag is enabled. 1 release · 2 other sources · first seen Oct 2025

release

  • Adds jwt-hack shell, a TUI-based interactive shell for running existing jwt-hack actions v2.5.0 · Mar 2026 · source · release history

command line

example

  • Launch the interactive terminal UI to explore JWT capabilities without memorizing flags. jwt-hack shell v2.5.0 · Mar 2026 · source
JWE handling verified Parses JWE tokens, displaying key-management and encryption algorithm metadata, and produces JWE tokens via direct encryption, enforcing minimum key-length requirements. 2 other sources · first seen Aug 2026

we ran it

  • The tool parsed the JWE header and its five components — showing key management as dir and encryption as A256GCM — but could not decrypt the ciphertext without a key. Aug 2026 · the full run
  • Reported a JWE encode error: the supplied secret test is only 4 bytes, whereas direct encryption requires a 16-byte (A128GCM) or 32-byte (A256GCM) key. Aug 2026 · the full run
RSA/ECDSA signing verified Signs JWTs using RSA or ECDSA algorithms by loading a private key from a PEM file supplied via a command-line flag. 2 other sources · first seen Oct 2025

Also counts toward: Command-line interface

command line

  • --private-key — - Path to private key file for RSA/ECDSA v2.4.0 · Oct 2025 · command-line history

we ran it

  • The tool failed with a file-not-found OS error because rsa-key.pem does not exist, then printed usage hints for both HMAC and RSA signing modes. Exit status 0 was returned despite the error. Aug 2026 · the full run
Targeted field brute-forcing shipped Allows brute-forcing of specific JWT fields like 'kid', 'jti', or 'jku' using custom patterns and minimum length constraints, extending beyond general secret cracking. 1 release · 1 other source · first seen Jun 2026

release

  • crack --target-field/--pattern targets specific JWT fields (kid, jti, jku) for brute-forcing with custom patterns v2.6.0 · Jun 2026 · source · release history

example

  • Brute-force a specific JWT field with a custom pattern starting from length 10 jwt-hack crack --target-field jti --pattern '^[a-z]{5}$' --min 10 <encoded_token> v2.6.0 · Jun 2026 · source
Claim validation verified Optionally validates JWT claims such as expiration time during decoding, controlled via a dedicated command-line flag. 1 release · 1 other source · first seen Oct 2020

Also counts toward: Command-line interface

release

command line

JWE vulnerability attacks shipped Includes specialized attacks for JWE tokens, such as padding-oracle detection with statistical timing baselines and misconfiguration detection. 1 release · first seen Jun 2026

Shared capability: Web vulnerability scanning

release

  • New JWE decryption attacks include padding-oracle detection with statistical timing baselines and misconfiguration detection v2.6.0 · Jun 2026 · source · release history
HMAC secret configuration verified Accepts a user-supplied secret string for HMAC-based JWT signing and verification via a dedicated command-line option. 1 other source · first seen Oct 2025

Also counts toward: Command-line interface

command line

EdDSA signature verification shipped Verifies JWT signatures using the EdDSA (Edwards-curve Digital Signature Algorithm). 1 release · first seen Aug 2025

release

  • EdDSA (Edwards-curve Digital Signature Algorithm) signature verification v2.2.0 · Aug 2025 · source · release history
JWE decryption shipped Decrypts JWE tokens, recovering the plaintext payload and metadata. 1 release · first seen Aug 2025

release

ARM64 architecture support shipped Supports execution on Windows ARM64 architectures. 1 release · first seen May 2024

release

Modern JWT library integration shipped Migrates internal JWT library to golang-jwt, enabling use of modern token claims and signing methods. 1 release · first seen May 2024

release

  • Migrates internal JWT library from jwt-go to golang-jwt, enabling use of modern token claims and signing methods v1.2.0 · May 2024 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for jwt-hack, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail jwt-hack puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

10 entries

  1. June 20261
  3. March 20261
  5. October 20251
  7. September 20251
  9. August 20252
  12. June 20251
  14. May 20241
  16. October 20211
  18. October 20201

    10 entries

    1. v2.6.0 Jun 5, 2026 · release notes

      jwt-hack v2.6.0 adds JWE support, JWKSJWKSA JSON Web Key Set, a published collection of cryptographic keys. Applications use it to find the public key needed to verify a token's signature. subcommand, new attack payloads, and targeted brute-force flags

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.6.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.6.0
      └──▷ TRY IT
      Fetch and verify a token against a remote JWKS to check for key rotation issues
      $ jwt-hack jwks --url https://example.com/.well-known/jwks.json --token <encoded_token>
      Brute-force a specific JWT field with a custom pattern starting from length 10
      $ jwt-hack crack --target-field jti --pattern '^[a-z]{5}$' --min 10 <encoded_token>
      Export scan results to a JSON report for automated analysis
      $ jwt-hack scan --target-field kid <encoded_token> --report /tmp/scan_report.json
      • encode_jwe/decrypt_jwe APIs enable encoding and decrypting JSON Web Encryption (JWE) tokens with full key management for RSARSAThe oldest widely used public-key algorithm, for both encryption and signatures, with security resting on factoring large numbers. A large quantum computer would break it.-OAEP, ECDH-ES, A128KW, A256KW, Direct and content encryption via A128GCM/A256GCM
      • New jwks subcommand fetches, spoofs (via jku/x5u), verifies tokens against a JWKS endpoint, and tests for key-rotation vulnerabilities
      • scan --report <path> exports JSON or HTML reports from scan results; global --json mode applies to all commands
      • New JWE decryption attacks include padding-oracle detection with statistical timing baselines and misconfiguration detection
      • crack --min starts brute-force from a specified minimum password length
      +3 more show less
      • crack --target-field/--pattern targets specific JWT fields (kid, jti, jku) for brute-forcing with custom patterns
      • New attack payloads include x5c_signed, psychic (CVE-2022-21449), typ_confusion, alg_edge, jku/x5u SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. probes, zip (DEFLATE bomb), kid_predictable, dup_key, nested, jwk_embed_ec, jws_json, alg_family_swap, none_sig, header_quirks, and kid_wildcard
      • Support for ES512 (P-521) JWT signing via josekit

      8 details in Everything

    2. v2.5.0 Mar 2, 2026 · release notes

      jwt-hack v2.5.0 adds jwt-hack shell TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. interactive command

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.5.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.5.0
      └──▷ TRY IT
      Launch the interactive terminal UI to explore JWT capabilities without memorizing flags.
      $ jwt-hack shell
    3. v2.4.0 Oct 26, 2025 · release notes

      New jwt-hack scan subcommand for vulnerability scanning, server mode, and --config flag support

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.4.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.4.0
      • Adds jwt-hack scan subcommand to perform JWT vulnerability scanning
      • Adds jwt-hack server subcommand to enable API server mode
      • Adds --config flag to specify configuration files from HOME and XDGXDGA set of specifications maintained by freedesktop.org that standardise where Linux applications store config, data, and cache files, letting tools respect user-defined paths instead of hardcoding locations. directories

      3 details in Everything

    4. v2.3.0 Sep 11, 2025 · release notes

      jwt-hack v2.3.0 adds --preset flag for crack mode and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Client integration examples.

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.3.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.3.0
      • Adds --preset flag to crack mode for selecting character set presets, enabling faster brute-force without manually specifying character sets.

      1 detail in Everything

    5. v2.2.0 Aug 29, 2025 · release notes

      jwt-hack v2.2.0 adds JWE support, EdDSAEdDSAA fast elliptic-curve signature scheme with small keys, the default for new SSH keys and common in code signing. It is not quantum-safe. algorithms, and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server mode

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.2.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.2.0
      • MCP server mode for AI model integration
      • JWE (JSON Web Encryption) decryption capabilities
      • EdDSA (Edwards-curve Digital Signature Algorithm) signature verification

      3 details in Everything

    6. v2.1.0 Aug 10, 2025 · release notes

      Adds zip: DEF header support for DEFLATE-compressed JWT payloads

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.1.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.1.0
      └──▷ TRY IT
      Handle a JWT that has been compressed using the DEFLATE algorithm via the zip header.
      $ jwt-hack decode jwt_token_with_deflate.zip --zip
      • Add JWT compression support with zip: DEF header for DEFLATE compression

      1 detail in Everything

    7. v2.0.0 Jun 6, 2025 · release notes

      jwt-hack v2.0.0 adds PS and ES algorithm cracking to crack command

      └──▷ GET THIS VERSION 
      $ git clone --branch v2.0.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v2.0.0
      • crack subcommand now supports cracking JSON Web Tokens using RSASSA-PSS (PS) and ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. (ES) signature algorithms
      • New SQL Injection detection module that tests JWT claims for SQLiSQLiAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. attack vectors

      2 details in Everything

    8. v1.2.0 May 21, 2024 · release notes

      jwt-hack v1.2.0 adds Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. support and migrates to golang-jwt.

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.2.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v1.2.0
      • Supports execution on Windows ARM64 architectures
      • Migrates internal JWT library from jwt-go to golang-jwt, enabling use of modern token claims and signing methods

      2 details in Everything

    9. v1.1.0 Oct 3, 2021 · release notes

      Add jku/x5u payload types for JWT bypass scenarios

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.1.0 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v1.1.0
    10. v1.0.2 Oct 24, 2020 · release notes

      jwt-hack v1.0.2 adds more detailed output in decode mode

      └──▷ GET THIS VERSION 
      $ git clone --branch v1.0.2 https://github.com/hahwul/jwt-hack.git
# already have the repo? check out this version:
$ git checkout v1.0.2
      • Shows more information when running the decode command

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in hahwul/jwt-hack, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 6 +2 vs prior 12 months
    2. Maintainers 1 +0 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 8% of issues opened, last 12 months
    5. Median time to close 105 days first maintainer reply 71 days
    6. Open backlog 0 of 48 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 1
    4. Commits / month 5
    5. Stars 1,082
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback