# ticarpi/jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

Repository: https://github.com/ticarpi/jwt_tool
Canonical: https://ross.abutalabs.com/products/jwt_tool
Language: Python
License: GPL-3.0
License Family: copyleft
Last push: 2025-05-01T11:57:50+00:00

## Health v2 (maintenance only)
Score: 31/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 19, release rhythm 8, longevity 100
- inputs: {"age_days": 3509, "days_push": 489, "days_rel": 489, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 6754, forks 817 (observed 2026-08-28T04:09:48.335252+00:00)

## What it is
A Python command-line toolkit for validating, forging, scanning, and tampering with JSON Web Tokens (JWTs). It automates checks for known JWT exploits (alg=none bypass, RS/HS256 mismatch, key injection, Psychic Signature), scans for misconfigurations, and performs high-speed dictionary attacks to identify weak signing keys.

## Use cases
- test jwt tokens for known vulnerabilities
- crack weak jwt secret keys with a dictionary attack
- forge json web tokens with a new signature
- scan jwt implementation for misconfigurations
- pentest authentication that uses json web tokens
- tamper with jwt claims and timestamps
- solve ctf challenges involving json web tokens

## When to choose
- you are a pentester auditing how an application issues and verifies JWTs
- you want an automated check for the well-known JWT CVEs and misconfigurations in one tool
- you need to brute-force or crack weak HMAC secrets used to sign tokens
- you are tackling a CTF challenge that hinges on JWT weaknesses
- you are a developer stress-testing your own JWT library usage against forged tokens

## When to avoid
- you need a library to create and verify JWTs inside production application code - use a proper JWT library instead
- you just want a quick visual decode of a token with no attack tooling - a web decoder like jwt.io suffices
- you are working with non-JWT token formats such as PASETO or opaque session tokens
- you need a GUI-driven workflow rather than a command-line tool

## Facets
- artifact type: cli-tool
- maturity: active
- function: penetration-testing, vulnerability-scanning, security, cryptography, fuzzing, cli, developer-tools
- domain: security, penetration-testing, developer-tools, apis
- platform: python, cli, windows, cross-platform
- tags: jwt, json-web-tokens, token-cracking, token-forging, tampering, ctf, pentesting, dictionary-attack, auth-testing, docker, linux, macos

## Member repositories
- ticarpi/jwt_tool (main) score 31

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:48.335252+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:42:34.585817+00:00, confidence not recorded.
  - readme: https://github.com/ticarpi/jwt_tool (fetched 2026-08-28T04:09:48.335252+00:00, sha f15ed03b5c16)
- Data as of 2026-08-30T08:39:29.467469+00:00.