myjwt

What it is and what it does

MyJWT is a command-line pentesting tool designed for security researchers, CTF players, and developers to inspect, modify, and test JWT tokens. It provides a user interface for decoding JWTs, altering headers and payloads, signing with custom keys, and attempting to crack or verify signatures through brute-force or regex-based attacks. The tool also includes features to test known JWT vulnerabilities such as the none algorithm, RSA/HMAC confusion, kid injection, and jku/x5u header bypasses.

The tool operates as a standalone CLI with no external runtime dependencies, making it lightweight to install and run. It can modify JWT components, send crafted tokens to target URLs with custom HTTP methods and data, and copy results to the clipboard for easy integration into testing workflows. It's particularly useful for security assessments where JWT validation logic needs to be tested or where token manipulation is part of the attack surface.

Use it for:

• Test for the none algorithm vulnerability in JWT implementations by attempting to bypass signature verification.
• Brute-force JWT secrets using a wordlist to discover weak signing keys used in production systems.
• Modify JWT payloads and headers to test authorization bypass or privilege escalation in web applications.
• Exploit RSA/HMAC algorithm confusion to forge valid signatures using a public key as the HMAC secret.
• Test jku and x5u header injection vulnerabilities to bypass JWT validation through external key sources.
• Crack JWT signatures using regex patterns to guess keys based on known character sets or patterns.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A command-line tool for testing and manipulating JSON Web Tokens (JWTs), including modification, signing, verification, and exploitation of common JWT vulnerabilities.

Yes. The tool is actively maintained, has no external dependencies, supports current Python versions, carries a permissive license, and has no known vulnerabilities. It is well-suited for security professionals and developers who need to test JWT implementations. Install it if you regularly perform JWT security assessments or CTF challenges.

Install

myjwt on PyPI

pip install myjwt

uv add myjwt

poetry add myjwt

Installing myjwt

Before you install

Low install friction with no runtime dependencies. Actively maintained with recent commits and production-stable status; supports current Python versions (3.10, 3.11, 3.12).

License in practice

Permissive license allows use in commercial and private projects with minimal restrictions.

Quickstart

pip install myjwt
myjwt YOUR_JWT_TOKEN --print
myjwt YOUR_JWT_TOKEN --add-payload "username=admin" --sign mysecretkey

Requires Python 3.10 or later.

Verify before relying

• Whether the tool's exploitation features (RSA/HMAC confusion, kid injection, jku/x5u bypass) work reliably against real-world JWT implementations.
• Whether brute-force and regex-crack features scale adequately for large wordlists or complex patterns.
• Whether the clipboard integration and HTTP request features work consistently across different operating systems.

Package facts

Evidence: myjwt-2.1.0-py3-none-any.whl

Tags

More WWW/HTTP packages