Security tool · inject
jwt_tool
Swiss-army knife for JWTs: decode, tamper claims, and test the classic attacks - alg:none, key confusion (RS→HS), weak-secret cracking, and kid injection.
Overview
Where jwt_tool fits
Swiss-army knife for JWTs: decode, tamper claims, and test the classic attacks - alg:none, key confusion (RS→HS), weak-secret cracking, and kid injection.
Detection-first use
Start with the least intrusive template that can distinguish your hypothesis from a normal response. Preserve raw output and a negative control.
Install
Installation references
Install with gitAuthorization required
git clone https://github.com/ticarpi/jwt_tool && cd jwt_tool && pip install -r requirements.txt- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Test safely
Command templates
Run all attacksAuthorization required
Populate placeholders only with assets that are explicitly in scope.
python3 jwt_tool.py {token} -M at- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Crack weak secretAuthorization required
Populate placeholders only with assets that are explicitly in scope.
python3 jwt_tool.py {token} -C -d {wordlist}- Positive signal
- Tool-specific output that supports the stated hypothesis.
- Negative control
- No result, or identical behavior against a known-safe control.
- Intrusiveness
- Review flags and target scope before execution.
Related
Continue the workflow
Sources
Attribution and verification
Version history: normalized permanent page created 2026-08-20. Upstream activity and popularity are separate signals and do not establish tool safety.