jwt_tool is a command-line security testing toolkit for examining, manipulating and assessing JSON Web Tokens (JWTs). It helps penetration testers and developers identify weaknesses in token-based authentication and authorisation mechanisms.
JSON Web Tokens are widely used to exchange authentication and authorisation information between applications and services. Although they can provide a secure means of handling identity information, implementation mistakes involving signature validation, cryptographic keys and token claims can introduce serious vulnerabilities.
jwt_tool allows users to decode tokens, inspect their contents, modify claims and test whether applications correctly validate signatures. It includes checks for known JWT vulnerabilities, including algorithm confusion, unsigned tokens, weak signing keys and problems involving JSON Web Key Sets (JWKS).
The software also supports automated security scans, claim fuzzing and dictionary-based key testing. Tokens can be submitted directly to web applications or incorporated into captured HTTP requests, allowing testers to investigate authentication behaviour and access controls.
This is free and open source software.
Key Features
- Decode and inspect JSON Web Token headers, payloads and signatures.
- Validate token signatures using supplied cryptographic keys.
- Modify token claims, headers and expiration timestamps.
- Test for algorithm confusion and unsigned-token vulnerabilities.
- Investigate weaknesses involving RSA and HMAC signature verification.
- Check for known JWT vulnerabilities, including key injection and ECDSA signature validation flaws.
- Perform dictionary attacks to identify weak signing secrets.
- Test JSON Web Key Sets and public key configurations.
- Fuzz claim values to investigate authentication and authorisation behaviour.
- Run automated security checks using the JWT Attack Playbook.
- Generate RSA and ECDSA cryptographic keys.
- Submit modified tokens directly to web applications for testing.
- Import captured HTTP requests containing authentication tokens.
- Configure custom HTTP headers, cookies and proxy settings.
- Control request rates during automated security assessments.
- Log tested tokens and responses for subsequent analysis.
Website: github.com/ticarpi/jwt_tool
Support:
Developer: Andy Tyler and contributors
License: GNU General Public License v3.0
jwt_tool is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Security Testing | |
|---|---|
| ZAP | Web app scanner |
| mitmproxy | Interactive HTTPS proxy |
| Wfuzz | Web application fuzzer and Python library for security assessments |
| sqlmap | Penetration testing tool |
| Dalfox | Identify cross-site scripting vulnerabilities in web applications |
| Commix | Python-based penetration testing tool |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.