jwt_tool

python jwt_tool.py <token> -M pb

Suite for attacking and manipulating JSON Web Tokens (JWT), including brute-forcing secrets and modifying claims.

When you encounter a JWT in an application and want to test vulnerabilities such as none algorithm, brute-forcing the secret (HS256), or modifying claims. jwt_tool is a versatile tool for all JWT attacks.

If the JWT uses RS256 with trusted public keys, brute-force attacks won't work. Also if the token is short-lived and you cannot modify it before it expires.