What is JWT Cracker?
JWT Cracker is a free, high-performance online tool for testing the security of JSON Web Tokens (JWT). It uses the WebCrypto API to efficiently crack JWT secrets signed with HMAC algorithms including HS256, HS384, and HS512.
Features
- Crack HS256, HS384, and HS512 signed JWT tokens
- Upload custom wordlists or use built-in SecLists
- AI-generated common JWT secrets included
- Real-time progress tracking with speed metrics
- Drag and drop to prioritize wordlist sources
- 100% browser-based - your tokens never leave your device
- High performance: 50,000-100,000+ attempts per second
How to Use JWT Cracker
- Paste your JWT token in the input field
- Select or upload wordlists containing potential secrets
- Click Start Cracking to begin the dictionary attack
- If found, the secret will be displayed for you to copy
Supported JWT Algorithms
JWT Cracker supports HMAC-based signing algorithms that use symmetric keys:
- HS256 - HMAC using SHA-256 hash algorithm
- HS384 - HMAC using SHA-384 hash algorithm
- HS512 - HMAC using SHA-512 hash algorithm
Note: RSA (RS256, RS384, RS512) and ECDSA (ES256, ES384, ES512) algorithms use asymmetric keys and cannot be cracked with dictionary attacks.
Security Notice
This tool is intended for authorized security testing and educational purposes only. Only use JWT Cracker on tokens you own or have explicit permission to test. Unauthorized access to computer systems is illegal.
Privacy
JWT Cracker runs entirely in your browser using the WebCrypto API. Your JWT tokens and secrets are never sent to any server. All processing happens locally on your device.