Find authentication flaws in JWT-based apps.
What it does
Assesses JWT authentication weaknesses and produces security findings with impact and remediation guidance.
When to use it
Use during authorized penetration tests or audits of applications, APIs, SSO, and microservices that use JWTs.
How to use it
Give it a valid application JWT and an authorized testing target; it tests token security and returns structured vulnerability findings.
What you provide
- a valid JWT
Good to know
- cannot be undone: target.example.com
Latest review
What you need · 5
Requires Python 3 to run jwt_tool and the custom token-testing examples.
Lists jwt_tool as a prerequisite and uses it throughout the attack workflow.
Access · 3
This skill
target.example.com
Write
Sends tokens and changes authentication state (irreversible)
attacker.example.com
Write
Hosts attacker-controlled signing keys