Book Your API Security Demo Now
JWT Heartbreaker is a Burp extension designed to find thousands of weak secrets automatically. This extension will automatically find JWT tokens in all the proxied HTTP requests and check for any secrets weaknesses. The extension is available under a GPL license, which is based on the extension JSON Web Tokens (JWT4B).

Thousands of weak secrets detected
Automatically identifies JWT vulnerabilities at scale.
Automatic token discovery
Finds all JWT tokens in proxied requests.
Burp Suite integration
Seamlessly extends Burp Suite security testing capabilities.
HTTP proxy support
Works with all proxied HTTP traffic.