brendan-rius/c-jwt-cracker
FreeJWT brute force cracker written in C
FreeFree tier
About brendan-rius/c-jwt-cracker
A multi-threaded JWT brute-force cracker written in C. It attempts to recover the secret key of a JWT token by iterating through possible keys, allowing the user to specify the hash algorithm (HS256, HS384, HS512, or any OpenSSL HMAC-supported function), a custom alphabet, and maximum secret length. Designed for security testing and educational purposes only. Includes Docker support and uses Apple's Base64 implementation.
Key Features
Multi-threaded brute-force cracking of JWT secret keys
Written in C for performance
Supports HMAC with SHA256, SHA384, SHA512, and other OpenSSL hash functions
Customizable alphabet and maximum secret length
Docker support for easy deployment
Uses Apple's Base64 implementation
Pros & Cons
Pros
- Very fast on modern hardware (example: recovers a 4-character key in under a second)
- Supports multiple HMAC algorithms (HS256, HS384, HS512) via command-line parameter
- Extensible to any OpenSSL HMAC-supported function
- Includes Docker image for easy execution without manual compilation
- Allows limiting search space with custom alphabet and max length
Cons
- Requires significant computing power or luck for longer/complex secrets
- Only intended for testing; not suitable for production or illegal use
- Manual compilation requires OpenSSL headers and development tools
- No built-in wordlist or dictionary attack; only brute-force
Best For
Security testing and penetration testing of JWT implementationsEducational demonstrations of JWT secret strengthRecovering lost or weak JWT secrets in controlled environments
FAQ
How do I build and run c-jwt-cracker?
You can build a Docker image with 'docker build . -t jwtcrack' and run with 'docker run -it --rm jwtcrack <token>'. Alternatively, compile manually with 'make' (requires OpenSSL headers) and run './jwtcrack <token>'.
Which HMAC algorithms are supported?
The tool supports HMAC-SHA256 (HS256), HMAC-SHA384 (HS384), and HMAC-SHA512 (HS512). You can also specify any other hash function name recognized by OpenSSL for HMAC.
Can I customize the brute-force parameters?
Yes, you can specify a custom alphabet and maximum secret length as command-line arguments. For example: './jwtcrack <token> ABCSNFabcsnf1234 5 sha256' limits the search to those characters and max length 5.
Is this tool legal to use?
The tool is intended for testing purposes only. Do not use it on tokens you do not own or without explicit permission. The author states: 'do not put yourself in trouble'.