# hahwul/jwt-hack

JSON Web Token Hack Toolkit

Repository: https://github.com/hahwul/jwt-hack
Canonical: https://ross.abutalabs.com/products/jwt-hack
Homepage: http://jwt-hack.hahwul.com/
Language: Rust
License: MIT
License Family: permissive
Topics: jwt, hacking, bugbounty, security, tool, testing-tools, cracking, payload-generator, hacktoberfest
Last push: 2026-09-02T00:39:54+00:00

## Health v2 (maintenance only)
Score: 91/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 75, longevity 100
- inputs: {"age_days": 2253, "days_push": 1, "days_rel": 89, "gap_med": 43, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1075, forks 132 (observed 2026-09-03T02:15:12.561447+00:00)

## What it is
jwt-hack is a fast, single-binary Rust CLI toolkit for testing, analyzing, and attacking JSON Web Tokens (JWT) and JWE tokens. It supports encoding, decoding, verification, secret cracking, attack payload generation, automated vulnerability scanning, plus an API server and MCP server for automation.

## Use cases
- crack weak JWT signing secrets with dictionary or brute force
- generate JWT attack payloads like none-alg and algorithm confusion
- scan a JWT endpoint for common token vulnerabilities
- decode and inspect JWT and JWE token claims
- verify JWT signatures against a secret or public key
- perform kid SQL injection and jku/x5u header attacks
- integrate JWT analysis into AI agents via MCP

## When to choose
- you need a fast all-in-one CLI for JWT/JWE security testing
- you are doing bug bounty or pentest work involving tokens
- you want automated scanning for classic JWT vulnerabilities
- you need machine-readable JSON output or an API server for automation

## When to avoid
- you only need to issue or manage tokens in production code - use a JWT library instead
- you need a GUI-based token inspector
- you are not authorized to test the target system

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, penetration-testing, vulnerability-scanning, cli, cryptography, mcp
- domain: security, penetration-testing, developer-tools
- platform: cli, cross-platform, windows, rust
- tags: jwt, jwe, token-cracking, bugbounty, payload-generator, pentest, command-line, linux, macos, docker

## Member repositories
- hahwul/jwt-hack (main) score 91

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:12.561447+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:53:31.460923+00:00, confidence not recorded.
  - readme: https://github.com/hahwul/jwt-hack (fetched 2026-09-03T02:15:12.561447+00:00, sha 90f06a527c38)
  - homepage: http://jwt-hack.hahwul.com/ (fetched 2026-08-29T12:55:12.294922+00:00, sha 58ec07aa3dc4)
  - site_page: https://jwt-hack.hahwul.com/get_started/installation (fetched 2026-08-29T12:55:12.302773+00:00, sha 272227ea2171)
  - registry_crates: https://crates.io/api/v1/crates/jwt-hack (fetched 2026-08-29T12:55:12.304824+00:00, sha ccb6d78bb732)
  - site_page: https://jwt-hack.hahwul.com/get_started/introduction (fetched 2026-08-29T12:55:12.300654+00:00, sha c001d7c0fc2d)
- Data as of 2026-08-30T08:39:29.467469+00:00.