CLI reference

The jwtop CLI covers the full JWT workflow, including security testing.

find Extract JWT tokens hidden in text, a file, or stdin.

decode Inspect a token's header and claims without verifying the signature.

verify Validate a token's signature and standard claims.

create Mint a new signed token from scratch.

genkey Generate secure signing key material for an algorithm.

sign Re-sign an existing token with a different algorithm or key.

crack Probe a server for JWT vulnerabilities using all known exploits.

exploit Produce a modified token with a specific security exploit applied.

Every command that takes a <token> argument also accepts it via stdin when the argument is omitted, so commands compose in pipelines: jwtop find --file page.html | jwtop decode.

Global usage

jwtop <command> [flags]
jwtop --help
jwtop version

All commands exit 0 on success and 1 on error. Verification failure also exits 1.

Global flags

Flag	Description
--sqa-opt-out	Opt out of anonymous usage statistics and crash reporting