Question 1

How does JWT secret cracking work?

Accepted Answer

An HS256 JWT is signed with HMAC-SHA256 over header.payload using a shared secret. The cracker recomputes the HMAC for each candidate secret from a wordlist and compares it to the signature in the token. A match reveals the secret.

Question 2

Can this crack RS256 or strong secrets?

Accepted Answer

No. This only works against HMAC-based algorithms (HS256, HS384, HS512) signed with a weak, guessable secret. RS256/ES256 use asymmetric keys and cannot be brute-forced this way. Use a long random secret to stay safe.

Question 3

Is this tool legal to use?

Accepted Answer

It is a defensive and educational tool — use it only on tokens you own or are authorised to test (your own apps, CTF challenges, bug-bounty scopes). Cracking tokens you do not own may be illegal.

Question 4

Where does the cracking run?

Accepted Answer

Entirely in your browser using the Web Crypto API. The token and wordlist never leave your device, and processing happens in chunks via setTimeout so the page stays responsive.