hahwul/jwt-hack is one of the security-focused repositories TopGit tracks, currently at 1.1k stars, written primarily in Rust. JSON Web Token Hack Toolkit
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
Decode JWE (JSON Web Encryption) tokens to analyze their structure. The tool automatically detects JWE format (5 parts) and displays the encryption details.
# Decode JWE token structure
jwt-hack decode eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..ZHVtbXlfaXZfMTIzNDU2.eyJ0ZXN0IjoiandlIn0.ZHVtbXlfdGFn
# Shows JWE header, encrypted key, IV, ciphertext, and authentication tag
Create JWE (JSON Web Encryption) tokens for testing encrypted JWT scenarios.
# Basic JWE encoding
jwt-hack encode '{"sub":"1234", "data":"encrypted"}' --jwe --secret=your-secret
# JWE tokens are encrypted and can only be decrypted with the proper key
jwt-hack encode '{"sensitive":"data"}' --jwe
Verify a JWT
Checks if a JWT's signature is valid using the provided secret or key.
# With Secret (HMAC algorithms like HS256, HS384, HS512)
jwt-hack verify YOUR_JWT_TOKEN_HERE --secret=your-256-bit-secret
# With Private Key (for asymmetric algorithms like RS256, ES256, EdDSA)
jwt-hack verify YOUR_JWT_TOKEN_HERE --private-key path/to/your/RS256_private.key
Crack a JWT
Dictionary and brute force attacks also support JWTs compressed with DEFLATE.
Start a local REST API for automation and integrations. To require authentication, use --api-key and include X-API-KEY in requests.
# Start on localhost:3000 with API key protection
jwt-hack server --api-key your-api-key
# Example request (must include X-API-KEY when --api-key is set)
curl -s http://127.0.0.1:3000/health -H 'X-API-KEY: your-api-key'
MCP (Model Context Protocol) Server Mode
jwt-hack can run as an MCP server, allowing AI models to interact with JWT functionality through a standardized protocol.
# Start MCP server (communicates via stdio)
jwt-hack mcp
DEFLATE Compression Support
The jwt-hack toolkit supports DEFLATE compression for JWTs.
Use the --compress option with encode to generate compressed JWTs.
The decode and crack modes automatically detect and handle compressed JWTs.
Contribute
Urx is open-source project and made it with ❤️
if you want contribute this project, please see CONTRIBUTING.md and Pull-Request with cool your contents.
The most recent commit recorded on hahwul/jwt-hack was 8 days ago, based on the GitHub push timestamp. The repository has 131 forks — one of the better signals of community interest.
Is hahwul/jwt-hack open source?
Yes — hahwul/jwt-hack ships under the MIT license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/hahwul/jwt-hack.
What license does hahwul/jwt-hack use?
hahwul/jwt-hack is released under the MIT license. Always verify the LICENSE file directly on GitHub for the authoritative terms — license strings can be edited out of sync with a project's actual stance.
What topics is hahwul/jwt-hack associated with?
GitHub's repository topics for hahwul/jwt-hack: "bugbounty", "cracking", "hacking", "hacktoberfest", "jwt", "payload-generator", "security", "testing-tools", "tool". TopGit's editorial category is Security.
Where can I see hahwul/jwt-hack in action?
The project maintains a homepage at http://jwt-hack.hahwul.com/. The README tab on this page also usually contains screenshots and a quickstart.
Where do I read more about hahwul/jwt-hack?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/hahwul/jwt-hack is the definitive source.
Read full README in the tab above.
Is jwt-hack worth your time?
ChatGPT, Claude and Perplexity can all read this page. Ask one of them what it makes of jwt-hack.
/jwt-hack
