ticarpi/jwt_tool

Health v2 · maintenance only

Adoption not part of the score

6754 stars · 817 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A Python command-line toolkit for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It automates checks for known JWT exploits (alg=none bypass, RS/HS256 mismatch, key injection, Psychic Signature), scans for misconfigurations, and performs high-speed dictionary attacks to identify weak signing keys.

Use cases

• test jwt tokens for known vulnerabilities
• crack weak jwt secret keys with a dictionary attack
• forge json web tokens with a new signature
• scan jwt implementation for misconfigurations
• pentest authentication that uses json web tokens
• tamper with jwt claims and timestamps
• solve ctf challenges involving json web tokens

When to choose

• you are a pentester auditing how an application issues and verifies JWTs
• you want an automated check for the well-known JWT CVEs and misconfigurations in one tool
• you need to brute-force or crack weak HMAC secrets used to sign tokens
• you are tackling a CTF challenge that hinges on JWT weaknesses
• you are a developer stress-testing your own JWT library usage against forged tokens

When to avoid

• you need a library to create and verify JWTs inside production application code - use a proper JWT library instead
• you just want a quick visual decode of a token with no attack tooling - a web decoder like jwt.io suffices
• you are working with non-JWT token formats such as PASETO or opaque session tokens
• you need a GUI-driven workflow rather than a command-line tool

Facets

cli-tool · maturity active

penetration-testing vulnerability-scanning security cryptography fuzzing cli developer-tools security penetration-testing developer-tools apis python cli windows cross-platform jwt json-web-tokens token-cracking token-forging tampering ctf pentesting dictionary-attack auth-testing docker linux macos

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ticarpi/jwt_tool")