https://cybertoolchain.io/tools/jwt-hack New releases and features in jwt-hack, tracked by The Cyber Toolchain. en Fri, 05 Jun 2026 14:10:50 GMT https://github.com/hahwul/jwt-hack/releases/tag/v2.6.0 https://github.com/hahwul/jwt-hack/releases/tag/v2.6.0 Fri, 05 Jun 2026 14:10:50 GMT jwt-hack v2.6.0 adds JWE support, JWKS subcommand, new attack payloads, and targeted brute-force flags • `encode_jwe`/`decrypt_jwe` APIs enable encoding and decrypting JSON Web Encryption (JWE) tokens with full key management for RSA-OAEP, ECDH-ES, A128KW, A256KW, Direct and content encryption via A128GCM/A256GCM • New `jwks` subcommand fetches, spoofs (via jku/x5u), verifies tokens against a JWKS endpoint, and tests for key-rotation vulnerabilities • `scan --report <path>` exports JSON or HTML reports from scan results; global `--json` mode applies to all commands • New JWE decryption attacks include padding-oracle detection with statistical timing baselines and misconfiguration detection • `crack --min` starts brute-force from a specified minimum password length • `crack --target-field`/`--pattern` targets specific JWT fields (kid, jti, jku) for brute-forcing with custom patterns • New attack payloads include `x5c_signed`, `psychic` (CVE-2022-21449), `typ_confusion`, `alg_edge`, `jku`/`x5u` SSRF probes, `zip` (DEFLATE bomb), `kid_predictable`, `dup_key`, `nested`, `jwk_embed_ec`, `jws_json`, `alg_family_swap`, `none_sig`, `header_quirks`, and `kid_wildcard` • Support for ES512 (P-521) JWT signing via josekit Full history on Cyber Toolchain: https://cybertoolchain.io/tools/jwt-hack https://github.com/hahwul/jwt-hack/releases/tag/v2.4.0 https://github.com/hahwul/jwt-hack/releases/tag/v2.4.0 Sun, 26 Oct 2025 12:54:34 GMT New `jwt-hack scan` subcommand for vulnerability scanning, `server` mode, and `--config` flag support • Adds `jwt-hack scan` subcommand to perform JWT vulnerability scanning • Adds `jwt-hack server` subcommand to enable API server mode • Adds `--config` flag to specify configuration files from HOME and XDG directories Full history on Cyber Toolchain: https://cybertoolchain.io/tools/jwt-hack https://github.com/hahwul/jwt-hack/releases/tag/v2.2.0 https://github.com/hahwul/jwt-hack/releases/tag/v2.2.0 Fri, 29 Aug 2025 08:46:13 GMT jwt-hack v2.2.0 adds JWE support, EdDSA algorithms, and an MCP server mode • `MCP` server mode for AI model integration • JWE (JSON Web Encryption) decryption capabilities • EdDSA (Edwards-curve Digital Signature Algorithm) signature verification Full history on Cyber Toolchain: https://cybertoolchain.io/tools/jwt-hack https://github.com/hahwul/jwt-hack/releases/tag/v2.1.0 https://github.com/hahwul/jwt-hack/releases/tag/v2.1.0 Sun, 10 Aug 2025 04:19:48 GMT Adds `zip: DEF` header support for DEFLATE-compressed JWT payloads • Add JWT compression support with "zip": "DEF" header for DEFLATE compression Full history on Cyber Toolchain: https://cybertoolchain.io/tools/jwt-hack https://github.com/hahwul/jwt-hack/releases/tag/v2.0.0 https://github.com/hahwul/jwt-hack/releases/tag/v2.0.0 Fri, 06 Jun 2025 07:29:05 GMT jwt-hack v2.0.0 adds PS and ES algorithm cracking to `crack` command • `crack` subcommand now supports cracking JSON Web Tokens using RSASSA-PSS (`PS`) and ECDSA (`ES`) signature algorithms • New SQL Injection detection module that tests JWT claims for SQLi attack vectors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/jwt-hack