jwt_tool
Test and tamper JSON Web Tokens.
KaliParrotmedium
pkg: jwt-tool
jwt_tool decodes, tampers, signs and attacks JWTs (alg confusion, none, weak secrets) for auth testing.
Syntax
jwt_tool {token} [options]
Example
jwt_tool eyJ... -X a
Runs the "alg:none" attack to forge an unsigned token.
Advantages
- Covers common JWT attacks
- Crack/forge support
Disadvantages
- Auth-testing knowledge needed
- Targeted scope
Tags
#jwt#auth#web
Official docs: jwt_tool ↗
Related commands
Frequently asked questions
What is jwt_tool used for?
jwt_tool decodes, tampers, signs and attacks JWTs (alg confusion, none, weak secrets) for auth testing.
What is an example jwt_tool command?
A common example is: jwt_tool eyJ... -X a — Runs the "alg:none" attack to forge an unsigned token.
Is jwt_tool part of Kali Linux?
Yes. jwt_tool ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install jwt-tool.
What category of security tool is jwt_tool?
jwt_tool is a Web Application tool with a medium-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.