How do --crack and --sign work together?

--crack runs a dictionary from --dict against an HMAC-SHA token to recover the secret. Once you hold the key, --sign re-signs a tampered token so you can forge valid requests. RS and ES tokens are out of scope for crack mode because they use asymmetric keys.

Can jwt-tool confirm a bypass on a live app?

Yes. Send the forged token with --targeturl and set --canaryvalue to a string that only appears for an authenticated request. jwt-tool flags acceptance when that text shows up in the response.

How does jwt-tool compare with nuclei or hashcat?

nuclei can run JWT templates among many other checks; jwt-tool goes deeper on forge, crack, and claim tamper for one token. hashcat cracks HMAC secrets at GPU scale; jwt-tool keeps crack mode in the same auth-test workflow with --exploit and --targeturl.

What feeds jwt-tool in a workflow?

A JWT harvested from a response, cookie, or client storage. Wire that token into the node, choose --mode or --exploit, and send confirmed findings downstream to triage.

Updated Jul 14, 2026

Vulnerabilities

Test how apps verify forged and cracked JWTs

Decode, forge, crack, and tamper JWTs for auth checks.

Audit a token with the playbook Test signature-bypass exploits Crack a weak HMAC secret

overview

What jwt-tool does

jwt-tool works a single token end to end: decode and validate, forge and re-sign, crack weak HMAC secrets, and rewrite header or payload claims to probe how an application trusts the JWT.

Operator trigger is harvested auth tokens. Use --mode for playbook or all-tests scans, --exploit for alg:none, blank password, JWKS spoofing, or key confusion, and --crack with --dict for HMAC secrets. Confirm live acceptance with --targeturl and --canaryvalue.

Chain after a step that harvests tokens, then route confirmed bypasses into triage. The node takes a JWT and writes FILE plus FOLDER results. Prefer hashcat when you need GPU-scale HMAC cracking; prefer nuclei for broad non-JWT checks.

source github.com/ticarpi/jwt_tool

use cases

Where jwt-tool fits

Audit a token with the playbook

Run playbook mode against a JWT to walk the common checks at once and surface which signature and claim weaknesses the implementation allows.

Test signature-bypass exploits

Use the exploit options for alg:none, blank-password signatures, JWKS spoofing, or key confusion to see whether the server accepts a forged token.

Crack a weak HMAC secret

Run crack mode with a dictionary file against an HMAC-signed token to recover a guessable signing key and forge valid tokens from it.

Confirm a bypass against a live target

Send a tampered token to a target URL and check for a canary value in the response to verify the forged token is accepted.

reference

jwt-tool inputs and flags

27 inputs

Name	Type	Flag	Description
jwt	STRING	·	The JWT to test (skip if it is in the header or cookies).
mode	STRING	--mode	Scanning mode: pb playbook audit, er force errors, cc fuzz common claims, at all tests.
exploit	STRING	--exploit	Exploit known flaws: a alg:none, b blank password, s spoof JWKS, k key confusion, i inject inline JWKS.
crack	BOOLEAN	--crack	Crack the key for an HMAC-SHA token.
dict-file-crack	FILE	--dict	Dictionary file for cracking the signing key.
target-url	STRING	--targeturl	Target URL to send the forged request to.
canaryvalue	STRING	--canaryvalue	Text that appears in the response for a valid token.
sign	STRING	--sign	Sign the resulting token.

Showing key inputs. jwt-tool exposes 27 inputs in total.

Full flag reference (27 inputs)

Name	Type	Flag	Description
jwt	STRING	·	The JWT to test (no need to specify if it is in the header or cookies).
bare	STRING	--bare	Return tokens only.
mode	STRING	--mode	Scanning mode: pb playbook audit, er fuzz existing claims to force errors, cc fuzz common claims, at all tests.
sign	STRING	--sign	Sign the resulting token.
crack	BOOLEAN	--crack	Crack the key for an HMAC-SHA token.
query	STRING	--query	Query a token ID against the logfile to see the details of that request.
tamper	BOOLEAN	--tamper	Tamper with the JWT contents.
cookies	STRING	--cookies	Request cookies to send with the forged HTTP request.
exploit	STRING	--exploit	Exploit known flaws: a alg:none, b blank password accepted in signature, s spoof JWKS, k key confusion (set public key with --pubkey), i inject inline JWKS.
headers	STRING	--headers	Request headers to send with the forged HTTP request (repeatable for extra headers).
noproxy	STRING	--noproxy	Disable the proxy for the current request.
pub-key	FILE	--pubkey	Public key for asymmetric crypto.
verbose	STRING	--verbose	Produce slightly more verbose output when parsing and printing.
jwks-url	STRING	--jwksurl	URL where you host a spoofed JWKS.
jwksfile	FILE	--jwksfile	JSON Web Key Store for asymmetric crypto.
key-file	FILE	--keyfile	Keyfile for cracking (when signed with kid attacks).
postdata	STRING	--postdata	Data string to send in a POST request.
priv-key	FILE	--privkey	Private key for asymmetric crypto.
target-url	STRING	--targeturl	Target URL to send the forged request to.
verify-rsa	STRING	--verify	Verify the RSA signature against a public key.
canaryvalue	STRING	--canaryvalue	Text that appears in the response for a valid token (e.g. Welcome, ticarpi).
headerclaim	STRING	--headerclaim	Header claim to tamper with.
headervalue	STRING	--headervalue	Value (or file of values) to inject into the tampered header claim.
injectclaims	STRING	--injectclaims	Inject new claims and update existing claims with new values.
payloadclaim	STRING	--payloadclaim	Payload claim to tamper with.
payloadvalue	STRING	--payloadvalue	Value (or file of values) to inject into the tampered payload claim.
dict-file-crack	FILE	--dict	Dictionary file for cracking the signing key.

example

Run jwt-tool

jwt-tool · command

# crack a weak HMAC key, then forge alg:none and confirm the bypass on a live appjwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.Jf8v9Q --crack --dict /usr/share/wordlists/rockyou.txtjwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoiZ3Vlc3QifQ.Jf8v9Q --exploit a --targeturl https://example.com/api/account --canaryvalue "Welcome, admin"

sample output

Original JWT:jwttool_orig - eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... [+] EXPLOIT: "alg:none" - signature stripped[+] EXPLOIT: key confusion (RS256 to HS256) accepted[+] Weak HMAC key recovered from dictionary: hunter2 Sending tampered token to https://example.com/api/account ...[+] Response 200 (1487 bytes) - canary "Welcome, admin" found[+] Likely authentication bypass on example.com/api/account

guidance

Choosing jwt-tool

Use jwt-tool when an app authenticates with JWTs and you need to test signature verification, claim trust, or weak HMAC secrets. Harvest a token first, then run --mode or a specific --exploit. For broad web checks use nuclei; for GPU cracking use hashcat.

nuclei

JWT templates among thousands of checks. jwt-tool goes deeper on forging, cracking, and tampering one token.

hashcat

GPU-scale JWT signature cracking. jwt-tool crack mode is simpler and stays in the same forge-and-confirm workflow.

jaeles

Signature scanner for web apps. jwt-tool is the dedicated JWT specialist for the token itself.

faq

jwt-tool questions

Through --exploit: alg:none, blank-password signatures, JWKS spoofing, key confusion, and inline JWKS injection. Claim tampering uses --headerclaim, --payloadclaim, and --injectclaims. HMAC key recovery uses --crack with --dict. Guided scans use --mode (playbook, force-errors, common-claims, or all tests).

Run jwt-tool yourself

A JWT feeds jwt-tool, which audits, tampers, and forges against it and writes the test results as output for triage.

Run jwt-tool in Trickest Browse the library

Facts on this page come from the live Trickest tool library.

Test how apps verify forged and cracked JWTs

What jwt-tool does

Where jwt-tool fits

Audit a token with the playbook

Test signature-bypass exploits

Crack a weak HMAC secret

Confirm a bypass against a live target

jwt-tool inputs and flags

Run jwt-tool

Choosing jwt-tool

nuclei

hashcat

jaeles

jwt-tool questions

More Vulnerabilities tools

agentsleak

commix

dalfox

dnsreaper

find-gh-poc

golemhalt

Run jwt-tool yourself