Guide

JWT

The JWT tab is a workbench for JSON Web Tokens: decode one, edit its claims and re-sign it, and generate the classic attack payloads to test against the server. It goes further than the Decoder's read-only jwt-decode converter, which only shows you the parts.

gori JWT tab with a decoded HS256 token: the INPUT token under a ^T:→ENCODE lens chip, the decoded header JSON, and an ATTACKS list of 23 generated payloads including alg=none case variants and signature stripping
The JWT tab decodes a token live (header, payload, signature) and lists ready-to-send attack payloads: alg:none, weak-secret, and header injection.

Select a token anywhere (a History detail pane, Notes, …) and Space → Send to JWT to seed a new workbench sub-tab with it. Sessions are ephemeral: nothing is written to disk. If you have hidden the tab, reveal it again from the tab-bar ⋯ menu, the command palette (Ctrl-P → Go to JWT), or Preferences.

Two Lenses

One session, two views, toggled with Ctrl-T. The top card of each lens carries the switch on its border — ^T:→ENCODE on INPUT, ^T:→DECODE on HEADER — and clicking it does the same thing as the key:

Press l to load the token currently decoded on the Decode side into the Encode editors, so you can tweak a claim and re-sign in two moves. Copy any result with y.

A signature is decoded and shown but never verified, so a decode tells you what a token claims, not whether it is trusted. Encode genuinely signs with the secret and algorithm you give it. (The Cookie tab is the sibling that both verifies and re-signs.)

Attack Payloads

From a decoded token, gori generates ready-to-send variants that probe common JWT verification flaws:

Attack What it tests
alg:none Strips the signature and sets alg to none (plus None / NONE case variants), for a server that accepts unsigned tokens.
Weak secret Re-signs the token with a list of common weak HMAC secrets, to catch a guessable signing key.
Header injection Manipulates the kid, jku, x5u, and jwk header parameters, for a server that trusts attacker-supplied key material.

Send a candidate to Repeater to try it against the target, or straight into a request you're already editing.

Headless

gori run jwt eyJhbGci...                       # decode (default)
gori run jwt eyJhbGci... --encode --alg HS256 --secret s3cret
gori run jwt eyJhbGci... --encode --set role=admin --secret s3cret   # patch one claim, re-sign
gori run jwt eyJhbGci... --encode --payload '{"sub":"1","admin":true}' --secret s3cret   # replace the claims wholesale
gori run jwt eyJhbGci... --attacks             # print the attack payloads
cat token.txt | gori run jwt --attacks         # token from stdin

The token comes from the argument or stdin; there is no project or capture involved (it is pure local compute). --format is text or json. On --encode, --set KEY=VALUE patches one claim (repeatable — the value is JSON when it parses, so admin=true is a boolean and role=admin a string) and --payload JSON replaces the whole claims object; the two are mutually exclusive. See the CLI Reference.

Over MCP, jwt_decode / jwt_encode / jwt_attacks are read tools available even under --read-only, since they touch no network or state. jwt_encode takes the same set / payload claim edits.

Next Steps