brendan-rius/c-jwt-cracker

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2559 stars · 272 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A multi-threaded JWT brute-force secret key cracker written in C using OpenSSL. It attempts to recover the HMAC signing key of a JWT token so the token can be forged, for security testing purposes.

Use cases

• crack the secret key of a JWT token
• test whether my JWT signing secrets are too weak
• brute force HS256 HS384 HS512 HMAC keys
• audit JWT implementations for weak secrets
• recover a forgotten JWT signing key
• run a JWT cracker in Docker

When to choose

• you need a fast, multi-threaded C-based JWT secret brute-forcer
• you want to test JWTs signed with HS256/HS384/HS512 or other OpenSSL HMAC algorithms
• you want a simple Dockerized tool for a security assessment

When to avoid

• you need to crack asymmetric JWT algorithms like RS256 or ES256
• you need GPU-accelerated or distributed cracking at scale
• you want a maintained tool with active development

Facets

cli-tool · maturity maintenance

security cryptography penetration-testing cli security penetration-testing developer-tools cli jwt brute-force cracker hmac openssl pentest linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="brendan-rius/c-jwt-cracker")