Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
JWTweak — Detects the algorithm of input JWT Token and provide options to generate the new JWT token based on the user selected algorithm. | Kitploit
Tools/GitHubGitHub/rishuranjanofficial/jwtweak
Payload GenerationVulnerability AnalysisWeb SecurityCryptographyPenetration TestingAuthentication
GitHubrishuranjanofficial/jwtweak

JWTweak

Detects the algorithm of input JWT Token and provide options to generate the new JWT token based on the user selected algorithm.

View Repository
1031942 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

JWTweak

GitHub stars GitHub forks

Introduction

JWTweak is a guided, fully-offline JWT security-testing toolkit. It detects the algorithm of an input token, analyses it for risky configuration, recommends the attacks that fit, and walks you through each one — no flags to memorise.

Just run it:

root@kitploit:~
python3 JWTweak.py

Paste a token, and JWTweak decodes it, shows a risk report, and presents a smart menu with the relevant attacks highlighted. Every attack runs 100% offline — nothing is ever sent over the network.

⚠️ For authorised security testing and research only.

Download

MethodCommand / Link
Clone the full project (recommended)git clone https://github.com/rishuranjanofficial/JWTweak.git
Direct script downloadJWTweak.py
Latest releaseReleases page
root@kitploit:~
git clone https://github.com/rishuranjanofficial/JWTweak.git
cd JWTweak
pip install -r requirements.txt
python3 JWTweak.py

Highlights

  • Zero flags. Run it, paste a token, follow the menu. Nothing to look up.
  • Fully offline. No attack makes a network call. jku/x5u artifacts are generated locally, and JWTweak can even spin up a built-in local web server so you can host them without any external service.
  • Smart & guided. Auto-decodes, runs a risk analysis, and marks the attacks that make sense for your token as recommended.
  • Polished TUI via rich — panels, syntax-highlighted JSON, a risk table, and a live cracking progress bar. Falls back to a clean plain-text UI automatically if rich isn't installed.

Attack coverage

AreaWhat it does
Recondecode + risk analysis
Signature / algorithmalg:none variants, algorithm confusion (RS/ES → HMAC), re-sign with HS/RS/PS/ES/EdDSA, signature strip / bit-flip
Key-resolution headersjwk (CVE-2018-0114), jku, x5u, x5c injection — with optional built-in local hosting
Claims / keyskid path traversal / SQLi / command injection, interactive claim tampering, offline HMAC secret cracking
Automationone-tap "recommended suite" that writes every applicable token to a file

Requirements

  • Python 3.8+
  • pip install -r requirements.txt

PyJWT and cryptography are required; rich is optional (recommended) and only affects presentation.

Usage

Normally you never pass anything:

root@kitploit:~
python3 JWTweak.py

For convenience you can pre-load a token or file, or force the plain UI:

root@kitploit:~
python3 JWTweak.py eyJhbG...              # start with a token
python3 JWTweak.py token.jwt              # start with a file
python3 JWTweak.py --no-rich --no-color   # plain-text UI

Read more

A full walkthrough with step-by-step proof-of-concepts (alg:none and algorithm confusion) against a deliberately vulnerable demo app is available here: JWTweak: JWT Security Testing Toolkit

Author

Rishu Ranjan

Download Tool