usage: jwt-tool [-h] [-b] [-t TARGETURL] [-r REQUEST] [-rt RATE] [-i] [-rc COOKIES] [-rh HEADERS]
                [-pd POSTDATA] [-cv CANARYVALUE] [-np] [-nr] [-M MODE] [-X EXPLOIT] [-ju JWKSURL]
                [-S SIGN] [-pr PRIVKEY] [-T] [-I] [-hc HEADERCLAIM] [-pc PAYLOADCLAIM]
                [-hv HEADERVALUE] [-pv PAYLOADVALUE] [-C] [-d DICT] [-p PASSWORD] [-kf KEYFILE]
                [-V] [-pk PUBKEY] [-jw JWKSFILE] [-Q QUERY] [-v]
                [jwt]

positional arguments:
  jwt                   the JWT to tinker with (no need to specify if in header/cookies)

options:
  -h, --help            show this help message and exit
  -b, --bare            return TOKENS ONLY
  -t, --targeturl TARGETURL
                        URL to send HTTP request to with new JWT
  -r, --request REQUEST
                        URL request to base on
  -rt, --rate RATE      Max. number of requests per minute
  -i, --insecure        Use HTTP for passed request
  -rc, --cookies COOKIES
                        request cookies to send with the forged HTTP request
  -rh, --headers HEADERS
                        request headers to send with the forged HTTP request (can be used multiple times for additional headers)
  -pd, --postdata POSTDATA
                        text string that contains all the data to be sent in a POST request
  -cv, --canaryvalue CANARYVALUE
                        text string that appears in response for valid token (e.g. "Welcome, ticarpi")
  -np, --noproxy        disable proxy for current request (change in jwtconf.ini if permanent)
  -nr, --noredir        disable redirects for current request (change in jwtconf.ini if permanent)
  -M, --mode MODE       Scanning mode:
                        pb = playbook audit
                        er = fuzz existing claims to force errors
                        cc = fuzz common claims
                        at - All Tests!
  -X, --exploit EXPLOIT
                        eXploit known vulnerabilities:
                        a = alg:none
                        n = null signature
                        b = blank password accepted in signature
                        p = 'psychic signature' accepted in ECDSA signing
                        s = spoof JWKS (specify JWKS URL with -ju, or set in jwtconf.ini to automate this attack)
                        k = key confusion (specify public key with -pk)
                        i = inject inline JWKS
  -ju, --jwksurl JWKSURL
                        URL location where you can host a spoofed JWKS
  -S, --sign SIGN       sign the resulting token:
                        hs256/hs384/hs512 = HMAC-SHA signing (specify a secret with -k/-p)
                        rs256/rs384/rs512 = RSA signing (specify an RSA private key with -pr)
                        es256/es384/es512 = Elliptic Curve signing (specify an EC private key with -pr)
                        ps256/ps384/ps512 = PSS-RSA signing (specify an RSA private key with -pr)
  -pr, --privkey PRIVKEY
                        Private Key for Asymmetric crypto
  -T, --tamper          tamper with the JWT contents
                        (set signing options with -S or use exploits with -X)
  -I, --injectclaims    inject new claims and update existing claims with new values
                        (set signing options with -S or use exploits with -X)
                        (set target claim with -hc/-pc and injection values/lists with -hv/-pv
  -hc, --headerclaim HEADERCLAIM
                        Header claim to tamper with
  -pc, --payloadclaim PAYLOADCLAIM
                        Payload claim to tamper with
  -hv, --headervalue HEADERVALUE
                        Value (or file containing values) to inject into tampered header claim
  -pv, --payloadvalue PAYLOADVALUE
                        Value (or file containing values) to inject into tampered payload claim
  -C, --crack           crack key for an HMAC-SHA token
                        (specify -d/-p/-kf)
  -d, --dict DICT       dictionary file for cracking
  -p, --password PASSWORD
                        password for cracking
  -kf, --keyfile KEYFILE
                        keyfile for cracking (when signed with 'kid' attacks)
  -V, --verify          verify the RSA signature against a Public Key
                        (specify -pk/-jw)
  -pk, --pubkey PUBKEY  Public Key for Asymmetric crypto
  -jw, --jwksfile JWKSFILE
                        JSON Web Key Store for Asymmetric crypto
  -Q, --query QUERY     Query a token ID against the logfile to see the details of that request
                        e.g. -Q jwttool_46820e62fe25c10a3f5498e426a9f03a
  -v, --verbose         When parsing and printing, produce (slightly more) verbose output.

If you don't have a token, try this one:
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po