How do --crack and --sign work together?

--crack runs a dictionary from --dict against an HMAC-SHA token to recover the secret. Once you hold the key, --sign re-signs a tampered token so you can forge valid requests. RS and ES tokens are out of scope for crack mode because they use asymmetric keys.

Can jwt-tool confirm a bypass on a live app?

Yes. Send the forged token with --targeturl and set --canaryvalue to a string that only appears for an authenticated request. jwt-tool flags acceptance when that text shows up in the response.

How does jwt-tool compare with nuclei or hashcat?

nuclei can run JWT templates among many other checks; jwt-tool goes deeper on forge, crack, and claim tamper for one token. hashcat cracks HMAC secrets at GPU scale; jwt-tool keeps crack mode in the same auth-test workflow with --exploit and --targeturl.

What feeds jwt-tool in a workflow?

A JWT harvested from a response, cookie, or client storage. Wire that token into the node, choose --mode or --exploit, and send confirmed findings downstream to triage.

Updated Jul 14, 2026

Vulnerabilities

Test how apps verify forged and cracked JWTs

Decode, forge, crack, and tamper JWTs for auth checks.

Audit a token with the playbook Test signature-bypass exploits Crack a weak HMAC secret

overview

What jwt-tool does

jwt-tool works a single token end to end: decode and validate, forge and re-sign, crack weak HMAC secrets, and rewrite header or payload claims to probe how an application trusts the JWT.

Operator trigger is harvested auth tokens. Use --mode for playbook or all-tests scans, --exploit for alg:none, blank password, JWKS spoofing, or key confusion, and --crack with --dict for HMAC secrets. Confirm live acceptance with --targeturl and --canaryvalue.

Chain after a step that harvests tokens, then route confirmed bypasses into triage. The node takes a JWT and writes FILE plus FOLDER results. Prefer hashcat when you need GPU-scale HMAC cracking; prefer nuclei for broad non-JWT checks.

source github.com/ticarpi/jwt_tool

use cases

Where jwt-tool fits

Audit a token with the playbook

Run playbook mode against a JWT to walk the common checks at once and surface which signature and claim weaknesses the implementation allows.

Test signature-bypass exploits

Use the exploit options for alg:none, blank-password signatures, JWKS spoofing, or key confusion to see whether the server accepts a forged token.

Crack a weak HMAC secret

Run crack mode with a dictionary file against an HMAC-signed token to recover a guessable signing key and forge valid tokens from it.

Confirm a bypass against a live target

Send a tampered token to a target URL and check for a canary value in the response to verify the forged token is accepted.

reference

jwt-tool inputs and flags

27 inputs

Name	Type	Flag	Description
jwt	STRING	·	The JWT to test (skip if it is in the header or cookies).
mode	STRING	--mode	Scanning mode: pb playbook audit, er force errors, cc fuzz common claims, at all tests.
exploit	STRING	--exploit	Exploit known flaws: a alg:none, b blank password, s spoof JWKS, k key confusion, i inject inline JWKS.
crack	BOOLEAN	--crack	Crack the key for an HMAC-SHA token.
dict-file-crack	FILE	--dict	Dictionary file for cracking the signing key.
target-url	STRING	--targeturl	Target URL to send the forged request to.
canaryvalue	STRING	--canaryvalue	Text that appears in the response for a valid token.
sign	STRING	--sign	Sign the resulting token.

Showing key inputs. jwt-tool exposes 27 inputs in total.

Full flag reference (27 inputs)

Name	Type	Flag	Description
jwt	STRING	·	The JWT to test (no need to specify if it is in the header or cookies).
bare	STRING	--bare	Return tokens only.
mode	STRING	--mode	Scanning mode: pb playbook audit, er fuzz existing claims to force errors, cc fuzz common claims, at all tests.
sign	STRING	--sign	Sign the resulting token.
crack	BOOLEAN	--crack	Crack the key for an HMAC-SHA token.
query	STRING	--query	Query a token ID against the logfile to see the details of that request.
tamper	BOOLEAN	--tamper	Tamper with the JWT contents.
cookies	STRING	--cookies	Request cookies to send with the forged HTTP request.
exploit	STRING	--exploit	Exploit known flaws: a alg:none, b blank password accepted in signature, s spoof JWKS, k key confusion (set public key with --pubkey), i inject inline JWKS.
headers	STRING	--headers	Request headers to send with the forged HTTP request (repeatable for extra headers).
noproxy	STRING	--noproxy	Disable the proxy for the current request.
pub-key	FILE	--pubkey	Public key for asymmetric crypto.
verbose	STRING	--verbose	Produce slightly more verbose output when parsing and printing.
jwks-url	STRING	--jwksurl	URL where you host a spoofed JWKS.
jwksfile	FILE	--jwksfile	JSON Web Key Store for asymmetric crypto.
key-file	FILE	--keyfile	Keyfile for cracking (when signed with kid attacks).
postdata	STRING	--postdata	Data string to send in a POST request.
priv-key	FILE	--privkey	Private key for asymmetric crypto.
target-url	STRING	--targeturl	Target URL to send the forged request to.
verify-rsa	STRING	--verify	Verify the RSA signature against a public key.
canaryvalue	STRING	--canaryvalue	Text that appears in the response for a valid token (e.g. Welcome, ticarpi).
headerclaim	STRING	--headerclaim	Header claim to tamper with.
headervalue	STRING	--headervalue	Value (or file of values) to inject into the tampered header claim.
injectclaims	STRING	--injectclaims	Inject new claims and update existing claims with new values.
payloadclaim	STRING	--payloadclaim	Payload claim to tamper with.
payloadvalue	STRING	--payloadvalue	Value (or file of values) to inject into the tampered payload claim.
dict-file-crack	FILE	--dict	Dictionary file for cracking the signing key.

example

Run jwt-tool

jwt-tool · command

# crack a weak HMAC key, then forge alg:none and confirm the bypass on a live appjwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.Jf8v9Q --crack --dict /usr/share/wordlists/rockyou.txtjwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.Jf8v9Q --exploit a --targeturl https://example.com/api/account --canaryvalue "Welcome, admin"

sample output

Original JWT:jwttool_orig - eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... [+] EXPLOIT: "alg:none" - signature stripped[+] EXPLOIT: key confusion (RS256 to HS256) accepted[+] Weak HMAC key recovered from dictionary: hunter2 Sending tampered token to https://example.com/api/account ...[+] Response 200 (1487 bytes) - canary "Welcome, admin" found[+] Likely authentication bypass on example.com/api/account

guidance

Choosing jwt-tool

Use jwt-tool when an app authenticates with JWTs and you need to test signature verification, claim trust, or weak HMAC secrets. Harvest a token first, then run --mode or a specific --exploit. For broad web checks use nuclei; for GPU cracking use hashcat.

nuclei

JWT templates among thousands of checks. jwt-tool goes deeper on forging, cracking, and tampering one token.

hashcat

GPU-scale JWT signature cracking. jwt-tool crack mode is simpler and stays in the same forge-and-confirm workflow.

jaeles

Signature scanner for web apps. jwt-tool is the dedicated JWT specialist for the token itself.

faq

jwt-tool questions

Through --exploit: alg:none, blank-password signatures, JWKS spoofing, key confusion, and inline JWKS injection. Claim tampering uses --headerclaim, --payloadclaim, and --injectclaims. HMAC key recovery uses --crack with --dict. Guided scans use --mode (playbook, force-errors, common-claims, or all tests).

Run jwt-tool yourself

A JWT feeds jwt-tool, which audits, tampers, and forges against it and writes the test results as output for triage.

Run jwt-tool in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

jwt

STRING

The JWT to test (skip if it is in the header or cookies).

mode

STRING

--mode

Scanning mode: pb playbook audit, er force errors, cc fuzz common claims, at all tests.

exploit

STRING

--exploit

Exploit known flaws: a alg:none, b blank password, s spoof JWKS, k key confusion, i inject inline JWKS.

crack

BOOLEAN

--crack

Crack the key for an HMAC-SHA token.

dict-file-crack

FILE

--dict

Dictionary file for cracking the signing key.

target-url

STRING

--targeturl

Target URL to send the forged request to.

canaryvalue

STRING

--canaryvalue

Text that appears in the response for a valid token.

sign

STRING

--sign

Sign the resulting token.

Name

Type

Flag

Description

jwt

STRING

The JWT to test (no need to specify if it is in the header or cookies).

bare

STRING

--bare

Return tokens only.

mode

STRING

--mode

Scanning mode: pb playbook audit, er fuzz existing claims to force errors, cc fuzz common claims, at all tests.

sign

STRING

--sign

Sign the resulting token.

crack

BOOLEAN

--crack

Crack the key for an HMAC-SHA token.

query

STRING

--query

Query a token ID against the logfile to see the details of that request.

tamper

BOOLEAN

--tamper

Tamper with the JWT contents.

STRING

--cookies

Request cookies to send with the forged HTTP request.

exploit

STRING

--exploit

Exploit known flaws: a alg:none, b blank password accepted in signature, s spoof JWKS, k key confusion (set public key with --pubkey), i inject inline JWKS.

headers

STRING

--headers

Request headers to send with the forged HTTP request (repeatable for extra headers).

noproxy

STRING

--noproxy

Disable the proxy for the current request.

pub-key

FILE

--pubkey

Public key for asymmetric crypto.

verbose

STRING

--verbose

Produce slightly more verbose output when parsing and printing.

jwks-url

STRING

--jwksurl

URL where you host a spoofed JWKS.

jwksfile

FILE

--jwksfile

JSON Web Key Store for asymmetric crypto.

key-file

FILE

--keyfile

Keyfile for cracking (when signed with kid attacks).

postdata

STRING

--postdata

Data string to send in a POST request.

priv-key

FILE

--privkey

Private key for asymmetric crypto.

target-url

STRING

--targeturl

Target URL to send the forged request to.

verify-rsa

STRING

--verify

Verify the RSA signature against a public key.

canaryvalue

STRING

--canaryvalue

Text that appears in the response for a valid token (e.g. Welcome, ticarpi).

headerclaim

STRING

--headerclaim

Header claim to tamper with.

headervalue

STRING

--headervalue

Value (or file of values) to inject into the tampered header claim.

injectclaims

STRING

--injectclaims

Inject new claims and update existing claims with new values.

payloadclaim

STRING

--payloadclaim

Payload claim to tamper with.

payloadvalue

STRING

--payloadvalue

Value (or file of values) to inject into the tampered payload claim.

dict-file-crack

FILE

--dict

Dictionary file for cracking the signing key.

# crack a weak HMAC key, then forge alg:none and confirm the bypass on a live appjwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.Jf8v9Q --crack --dict /usr/share/wordlists/rockyou.txtjwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.Jf8v9Q --exploit a --targeturl https://example.com/api/account --canaryvalue "Welcome, admin"

Original JWT:jwttool_orig - eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... [+] EXPLOIT: "alg:none" - signature stripped[+] EXPLOIT: key confusion (RS256 to HS256) accepted[+] Weak HMAC key recovered from dictionary: hunter2 Sending tampered token to https://example.com/api/account ...[+] Response 200 (1487 bytes) - canary "Welcome, admin" found[+] Likely authentication bypass on example.com/api/account

Test how apps verify forged and cracked JWTs

What jwt-tool does

Where jwt-tool fits

Audit a token with the playbook

Test signature-bypass exploits

Crack a weak HMAC secret

Confirm a bypass against a live target

jwt-tool inputs and flags

Run jwt-tool

Choosing jwt-tool

nuclei

hashcat

jaeles

jwt-tool questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

kxss

sqlmap

subzy

Run jwt-tool yourself

Test how apps verify forged and cracked JWTs

What jwt-tool does

Where jwt-tool fits

Audit a token with the playbook

Test signature-bypass exploits

Crack a weak HMAC secret

Confirm a bypass against a live target

jwt-tool inputs and flags

Run jwt-tool

Choosing jwt-tool

nuclei

hashcat

jaeles

jwt-tool questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

kxss

sqlmap

subzy

Run jwt-tool yourself