Cracking Weak JWT HMAC Secrets

When a JWT is signed with HS256, its security rests entirely on the secret key. If that secret is a dictionary word, a default value, or a short string, it can be recovered offline — no interaction with the server required.

How it works

The signature is HMAC-SHA256(header.payload, secret). An attacker captures any valid token and runs an offline guess-and-check: for each candidate secret, recompute the HMAC and compare. Because this is offline, there is no rate limit and no lockout.

How to test

Feed a captured token to a cracker:

hashcat -m 16500 token.jwt wordlist.txt

Once the secret falls, you can forge any token — change sub, role, or exp and re-sign with the recovered key.

Impact

Equivalent to knowing the server's signing key: full token forgery and account/role takeover.

Defenses

• Use a long, random secret (≥ 32 bytes from a CSPRNG).
• Never ship default or example secrets to production; rotate any that leaked.
• Consider asymmetric signing (RS256/EdDSA) so the signing key never lives on verifying services.