JWT Secret Checker & Weak Key Audit (HMAC-SHA256/384/512)

Offline Weak Secret Dictionary Attack Test

Calculates HMAC signatures offline using Web Crypto against 106 top breach passwords.

Decoded Token Header
{
  "alg": "HS256",
  "typ": "JWT"
}
Decoded Token Payload
{
  "sub": "1234567890",
  "name": "Alice",
  "role": "admin",
  "iat": 1516239022
}
Detected AlgorithmHS256
Wordlist Keys106 Keys
Audit StatusReady
Local Check Time-

100% Offline Cryptography

HMAC calculations run using the Web Crypto API strictly within browser memory. Your production tokens and signatures never touch the network.

Full HMAC Spec Support

Accurately checks HS256, HS384, and HS512 tokens using standard Base64url signature encoding and binary digest comparisons.

Curated Wordlist Defense

Contains the top 100+ most commonly abused default and framework secrets found across real-world security breaches.

Technical Reference & Architecture Guide

JWT Secret Security Audit & Key Resilience Guide — Reference Guide

Methodology for identifying vulnerable HMAC secret keys, running client-side dictionary verification, and hardening JSON Web Tokens against signature forgery.

Key Parameters & Controls

tokenstring (JWT format)

Target JWT token comprising header, payload, and HMAC signature.

wordlistarray<string>

Collection of common weak secrets (e.g. secret, 123456, admin, company names).

algorithmenum ('HS256' | 'HS384' | 'HS512')

Symmetric HMAC hash algorithm declared in the JWT header.

Pro Tips & Best Practices

Production HMAC-SHA256 secrets must have at least 256 bits (32 random bytes) of cryptographic entropy.

Never use plain english dictionary words as JWT secrets; attackers can test millions of keys per second on modern GPUs.

Prefer asymmetric signatures (RS256 or EdDSA) when tokens are validated across multiple independent microservices.

Common Gotchas & Troubleshooting

This tool audits symmetric HMAC algorithms (HS256, HS384, HS512). Asymmetric keys (RS256) require a private key.

Check if your secret string is raw text or Base64-encoded binary before testing.

Frequently Asked Questions

Is my JWT token or secret transmitted over the internet?▼

No. The HMAC cryptographic hashing is executed using browser-native Web Crypto API strictly within client memory.

How fast is the in-browser dictionary test?▼

Web Crypto SubtleCrypto executes hundreds of candidate HMAC calculations in just a few milliseconds.

Which weak secrets are included in the audit wordlist?▼

The top 100+ most commonly abused keys found in real-world security breaches (e.g. 'secret', 'jwt_secret', 'admin123', 'password').

Can I test my own custom candidate secrets?▼

Yes, enter your candidate key in the verification field to confirm signature validity instantly.

Related Tools & Utilities

All Tools →
SSH Key Fingerprint Calculator & Randomart Visualizersecurity

Inspect OpenSSH public keys (RSA, Ed25519, ECDSA), compute SHA-256 and MD5 fingerprints, and generate authentic OpenSSH ASCII Randomart visual art.

Open tool→
Punycode & IDN Domain Converter (RFC 3492 & Spoofing Detector)security

Convert internationalized domain names (IDN) bidirectionally between Unicode and ASCII Punycode (xn--) with built-in homograph attack and script spoofing analysis.

Open tool→
Raw HTTP Header Parser & Cache/Security Inspectorsecurity

Parse raw HTTP request and response headers into structured key-value tables, inspect Cache-Control directives, evaluate security posture, and decode Set-Cookie tokens.

Open tool→
EFF Diceware Passphrase Generator (Shannon Entropy & Crack Time)security

Generate cryptographically secure, memorable multi-word passphrases using EFF Diceware wordlists, custom delimiters, number injection, and instant Shannon entropy calculation.

Open tool→
JWT Token Decoder & Security Inspectorsecurity

Decode JSON Web Tokens, inspect header/payload claims, calculate expiration time and verify integrity locally.

Open tool→
Cryptographically Secure Password Generatorsecurity

Generate ultra-secure passwords using Web Crypto API with custom length, symbols, and memorability.

Open tool→