{
  "slug": "jwt-weakness-checker",
  "name": "gizza-ai/jwt-weakness-checker",
  "version": "0.1.0",
  "title": "JWT Weakness Checker — Audit a JSON Web Token for Security Flaws — gizza.ai",
  "description": "Audit a JSON Web Token offline: alg:none, weak or guessable HMAC secrets, missing or expired expiry, absent iss/aud claims — each finding scored.",
  "tags": [
    "jwt security",
    "jwt weakness checker",
    "jwt audit",
    "alg none",
    "weak jwt secret",
    "jwt secret cracker",
    "json web token security",
    "jwt vulnerability scanner",
    "jwt expiry check"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/jwt-weakness-checker/",
    "markdown": "https://gizza.ai/tools/jwt-weakness-checker/index.md",
    "descriptor": "https://gizza.ai/tools/jwt-weakness-checker/tool.json",
    "deep_link_example": "https://gizza.ai/tools/jwt-weakness-checker/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.XbPfbIHMI6arZ3Y922BhjWgQzWXcXNrz0ogtVhfEd2o&wordlist=acme-staging-2026%2C%20acme-prod-2026&max_exp_days=30&leeway=0"
  },
  "cli": "gizza tool jwt-weakness-checker \"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.XbPfbIHMI6arZ3Y922BhjWgQzWXcXNrz0ogtVhfEd2o\"",
  "tool": {
    "description": "Audit a JSON Web Token (JWT) offline for security weaknesses: the alg:none / unsecured-token trap, weak or guessable HMAC secrets (dictionary attack over a built-in common-secret list plus any you supply), missing/expired/over-long expiry, missing iss/aud/iat/typ claims, kid-injection surface, algorithm-confusion risk, sensitive data in the payload, and oversized tokens. Returns a prioritized findings list with a 0-100 risk score. No secret or key is required and nothing leaves the device.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "leeway": {
          "description": "Clock-skew tolerance in seconds applied to exp/nbf checks (default 0).",
          "minimum": 0,
          "type": "integer"
        },
        "max_exp_days": {
          "default": 30.0,
          "description": "Lifetime (in days) above which the token's expiry is flagged as excessively long. Default 30; set 0 to disable this check.",
          "maximum": 365,
          "minimum": 0,
          "type": "number"
        },
        "now": {
          "description": "Reference time as seconds since the Unix epoch. When omitted (0), the current clock time is used for expiry checks.",
          "minimum": 0,
          "type": "integer"
        },
        "token": {
          "description": "The compact JWT to audit (header.payload.signature).",
          "type": "string"
        },
        "wordlist": {
          "description": "Extra candidate HMAC secrets to test, in addition to the built-in common-secret list. Separate by newlines or commas. Example: 'secret,changeme,company-name-2024'.",
          "type": "string"
        }
      },
      "required": [
        "token"
      ],
      "type": "object"
    }
  }
}