lmammino/jwt-cracker

Health v2 · maintenance only

Adoption not part of the score

1179 stars · 167 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

jwt-cracker is a Node.js command-line tool that brute-forces the signing secrets of HS256, HS384, and HS512 JWT tokens. It supports custom alphabets, maximum length limits, and dictionary files, and only works against weak secrets.

Use cases

• crack a jwt token with a weak hs256 secret
• audit jwt signing secrets for brute-force resistance
• test jwt tokens against a password dictionary
• recover a lost jwt secret from a token
• pentest tool for jwt token security assessment

When to choose

• you need a quick, simple CLI to test HS256/384/512 JWT secrets
• you want dictionary-based or alphabet-based brute forcing of JWT tokens
• you are doing a security audit of weak JWT signing keys

When to avoid

• tokens use RS256 or other asymmetric algorithms
• secrets are long and strong, making brute force infeasible
• you need GPU-accelerated or distributed cracking at scale

Facets

cli-tool · maturity maintenance

security cryptography cli penetration-testing security penetration-testing developer-tools cli cross-platform jwt brute-force hs256 token-cracking password-audit javascript command-line nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="lmammino/jwt-cracker")