CLI reference

The jwtop CLI covers the full JWT workflow, including security testing.

decode Inspect a token's header and claims without verifying the signature.

verify Validate a token's signature and standard claims.

create Mint a new signed token from scratch.

sign Re-sign an existing token with a different algorithm or key.

crack Probe a server for JWT vulnerabilities using all known exploits.

exploit Produce a modified token with a specific security exploit applied.

Global usage

jwtop <command> [flags]
jwtop --help
jwtop version

All commands exit 0 on success and 1 on error. Verification failure also exits 1.

Global flags

Flag	Description
--sqa-opt-out	Opt out of anonymous usage statistics and crash reporting