hahwul/jwt-hack

Health v2 · maintenance only

Adoption not part of the score

1075 stars · 132 forks observed · 2026-09-03

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

jwt-hack is a fast, single-binary Rust CLI toolkit for testing, analyzing, and attacking JSON Web Tokens (JWT) and JWE tokens. It supports encoding, decoding, verification, secret cracking, attack payload generation, automated vulnerability scanning, plus an API server and MCP server for automation.

Use cases

• crack weak JWT signing secrets with dictionary or brute force
• generate JWT attack payloads like none-alg and algorithm confusion
• scan a JWT endpoint for common token vulnerabilities
• decode and inspect JWT and JWE token claims
• verify JWT signatures against a secret or public key
• perform kid SQL injection and jku/x5u header attacks
• integrate JWT analysis into AI agents via MCP

When to choose

• you need a fast all-in-one CLI for JWT/JWE security testing
• you are doing bug bounty or pentest work involving tokens
• you want automated scanning for classic JWT vulnerabilities
• you need machine-readable JSON output or an API server for automation

When to avoid

• you only need to issue or manage tokens in production code - use a JWT library instead
• you need a GUI-based token inspector
• you are not authorized to test the target system

Facets

cli-tool · maturity active

security penetration-testing vulnerability-scanning cli cryptography mcp security penetration-testing developer-tools cli cross-platform windows rust jwt jwe token-cracking bugbounty payload-generator pentest command-line linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="hahwul/jwt-hack")