The format of JSON Web Token is:

encoded (header). encoded(payload). signature with a secret (for example, use sha256 to sign).

In case of hmac sha256 (HS256)-selected JWT, if the secret is not long and complex enough (e.g: "abc123"):

  1. Is it possible to brute force this token signature? (do not consider wrong signature upper limit)

  2. How is the difficulty to brute-force sh256?

  3. In JWT, break SH256 secret = successfully replicate the signature? (do not consider additional encryption)

2 Answers 2


Yes. If you crack the secret key used in the SHA256 signing you can create arbitrary JWT's yourself. The signature is a SHA256 HMAC, which does three two SHA256 operations, so it would be a little more than twice as slow as cracking plain SHA256. On commodity hardware you can do in the order of 10⁹ tries per second.

  • what means "three sha256 operations"?
    – TJCLK
    Commented Feb 23, 2017 at 9:11
  • 2
    It is actualy two SHA256 operations. HMAC ≈ SHA256(key + SHA256(key + message)). I included this to make it possible to say something about the speed of cracking HMAC. The speed of cracking SHA256 is known, and since HMAC does two SHA256 operations we can expect it to be twice as slow.
    – Sjoerd
    Commented Feb 23, 2017 at 9:19
  • let me check again, nonce is not included in hs256 and pure JWT, right?
    – TJCLK
    Commented Feb 23, 2017 at 10:08

Question 1: Is it possible to brute force this token signature?

Theoretically, Yes. BUT Two things you need to consider before even attempting to brute-force:

First: Does the secret change for every web token? If yes, then your cracking efforts are only good for that one token. Does the token contain so valuable information that you are willing to spend days or years worth of computational power on cracking it? Ask this to yourself.

Second: What is the length of your "encoded (header).encoded(payload).signature with a secret"? If you have access to unlimited processing power or unlimited amount of money, I suggest you read this post to understand how expensive, it will be to crack your hash.

Question 2: How is the difficulty to brute-force sha256?

Refer to second consideration of answer to question 1.

Question 3: In JWT, break sha256 secret = successfully replicate the signature?

I am not a JWT expert. However, if you believe the answers to above questions are acceptable, that means I understand the concept. So, to answer your question: Refer back to first consideration of answer to question 1. If your secret changes for every web token, you cannot replicate the signature to replay a transaction. Unless, if the secret change is trivial to predict, such as a numbered sequence. If the secret stays constant, then yes, you can replicate the signature.

  • You are confusing the length of the message with the length of the key.
    – Sjoerd
    Commented Feb 23, 2017 at 10:30
  • I see. Help me understand, what is the JWT signature made from. What goes as an input to the SHA256 hashing algorithm?
    – Amey
    Commented Feb 23, 2017 at 10:36
  • @amey: signature=HS256(encode64(header). encode(payload). secret), where secret is shared key like a "password", jwt.io/introduction
    – TJCLK
    Commented Feb 23, 2017 at 12:34
  • Thank you for the explanation. In this scenario, this secret is called a 'salt' in cryptography Wiki. In this context, my response makes perfect sense, if the salt is going to change with every request, then the cracking will only be good for that one request. If it is fixed, then by just cracking the hash once, Li Dong can replicate signatures. Also, how fast he will be able to compute the hash is completely dependent on the length of the message, that is, "encode64(header). encode(payload). secret". Li Dong - Could you please clarify
    – Amey
    Commented Feb 24, 2017 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .