Get Started

Decode

Inspect any JWT header and claims without needing the signing key.

Verify

Validate signatures against an HMAC secret, a PEM key, or a JWKS endpoint.

Create & sign

Mint new tokens or re-sign existing ones with a different algorithm or key.

Security testing

Probe live servers for JWT vulnerabilities or generate exploit tokens for manual testing.

Quick start

# Install
go install github.com/cerberauth/jwtop@latest

# Decode a token
jwtop decode $TOKEN

# Verify with an HMAC secret
jwtop verify $TOKEN --secret mysecret

# Probe a server for JWT vulnerabilities
jwtop crack $TOKEN --url https://api.example.com/protected

Explore the docs

Installation Install via go install, Homebrew, or Docker.

CLI reference All commands, flags, and exit codes.

Vulnerabilities Learn about JWT vulnerabilities and how to test them.

GitHub Actions Use jwtop in CI with cerberauth/jwtop-action.