{"id":38547455,"url":"https://github.com/justscrapeme/tiktok-web-reverse-engineering","last_synced_at":"2026-01-17T07:22:36.588Z","repository":{"id":293017766,"uuid":"981341868","full_name":"justscrapeme/tiktok-web-reverse-engineering","owner":"justscrapeme","description":"Tiktok Web Reverse Engineering \u0026 X-Gnarly implementation","archived":false,"fork":false,"pushed_at":"2025-09-18T13:48:37.000Z","size":32,"stargazers_count":67,"open_issues_count":0,"forks_count":16,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-09-18T15:59:53.875Z","etag":null,"topics":["api","signature","strdata","tiktok","tiktok-api","x-bogus","x-gnarly","x-mssdk-info"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/justscrapeme.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-05-10T22:12:00.000Z","updated_at":"2025-09-18T13:48:40.000Z","dependencies_parsed_at":null,"dependency_job_id":"a9b6e52d-bfab-469a-af59-9c52cfda80db","html_url":"https://github.com/justscrapeme/tiktok-web-reverse-engineering","commit_stats":null,"previous_names":["justscrapeme/tiktok-web-reverse-engineering"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/justscrapeme/tiktok-web-reverse-engineering","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justscrapeme%2Ftiktok-web-reverse-engineering","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justscrapeme%2Ftiktok-web-reverse-engineering/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justscrapeme%2Ftiktok-web-reverse-engineering/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justscrapeme%2Ftiktok-web-reverse-engineering/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/justscrapeme","download_url":"https://codeload.github.com/justscrapeme/tiktok-web-reverse-engineering/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/justscrapeme%2Ftiktok-web-reverse-engineering/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28503681,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-17T06:57:29.758Z","status":"ssl_error","status_checked_at":"2026-01-17T06:56:03.931Z","response_time":85,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","signature","strdata","tiktok","tiktok-api","x-bogus","x-gnarly","x-mssdk-info"],"created_at":"2026-01-17T07:22:36.457Z","updated_at":"2026-01-17T07:22:36.574Z","avatar_url":"https://github.com/justscrapeme.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TikTok Web Reverse Engineering\n\nThis project aims to open-source the latest TikTok Web security query param implementation called `X-Gnarly`.\n\n**If you want**:\n\n- 🤝 Work together on any part of TikTok Web\n- \u003cdetails\u003e\n  \u003csummary\u003e🔐 Signing algorithms API\u003c/summary\u003e\n\n  - `X-Bogus`\n  - `X-Gnarly`\n    - Version 5.1.3 (03.11.2025)\n    - Version 5.1.2 (07.09.2025)\n    - Version 5.1.1 (28.06.2025)\n    - Version 5.1.0 (10.05.2025)\n  - `strData`\n  - `x-mssdk-info`\n  - `_signature`\n  - `edata`\n  - `tt-ticket-guard-client-data` \u0026 `tt-ticket-guard-public-key`\n  \u003c/details\u003e\n\n- 👨‍💻 Fully-managed TikTok Web API (low price, excellent performance, high rate limits)\n- ⭐ [TikTok Captcha Solver](https://github.com/justscrapeme/tiktok-captcha-solver)\n- ⭐ Mass actions software (comments, likes, followers \u0026 others)\n- ⭐ Exclusive offers\n\nReach out to [t.me/justscrape](https://t.me/justscrape) to discuss a solution tailored to your needs.\n\n## Usage\n\n### Encoding\n\nEncoding implementation aims to convert the user request data to the `X-Gnarly` value. It lives under [encode.js](./encode.js).\n\nUsage example:\n\n```js\nlet xGnarly = encode(\n  {\n    queryString: \"WebIdLastTime=1746886547\u0026aid=1988\u0026app_language=en-GB\u0026app_name=tiktok_web\u0026browser_language=en-GB\u0026browser_name=Mozilla\u0026browser_online=true\u0026browser_platform=MacIntel\u0026channel=tiktok_web\u0026cookie_enabled=true\u0026data_collection_enabled=false\u0026device_platform=web_pc\u0026focus_state=true\u0026from_page=\u0026history_len=2\u0026is_fullscreen=false\u0026is_page_visible=true\u0026odinId=7502820379158911111\u0026permissionList=001004%2C001005\u0026priority_region=\u0026referer=\u0026screen_height=956\u0026screen_width=1470\u0026user_is_login=false\u0026webcast_language=en-GB\u0026msToken=\",\n    body: \"\",\n    userAgent: \"Mozilla/5.0 (Macintosh; Intel Mac OS X 1_1_1) AppleWebKit/111.11 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/111.11\"\n  }\n)\nconsole.log(xGnarly)\n```\n\nOutput:\n\n```js\nMktqXnEPLoZz6RyaxPytL6qu7/A1LU7LB4zGZOtQuq8szdGvK-mDaVbI8QiUYeDaPnAdwy6id5uQ5gT8s67MpQjR7OxrJVCQffmhoz-x-tQtI0iYmDlEcvHk6DxtFxKMq/4Y0kJHG6WxF0KVeIdapKtTlfvIaCzu3RsV/fHDQBELkIoX3x/cJP73pT6zy0F6gM-Et5rhfJXEl2KLwp93yF7Ki5XTmNMyw9NrRu8zqALAoiQNZEa-MF6nrJJXIeNUfVSiZGV9NUbRj\n```\n\n### Decoding\n\nDecoding implementation aims to decipher `X-Gnarly` and convert it back to the input object. It lives under [decode.js](./decode.js).\n\nUsage example:\n\n```js\nconst encoded = 'MktqXnEPLoZz6RyaxPytL6qu7/A1LU7LB4zGZOtQuq8szdGvK-mDaVbI8QiUYeDaPnAdwy6id5uQ5gT8s67MpQjR7OxrJVCQffmhoz-x-tQtI0iYmDlEcvHk6DxtFxKMq/4Y0kJHG6WxF0KVeIdapKtTlfvIaCzu3RsV/fHDQBELkIoX3x/cJP73pT6zy0F6gM-Et5rhfJXEl2KLwp93yF7Ki5XTmNMyw9NrRu8zqALAoiQNZEa-MF6nrJJXIeNUfVSiZGV9NUbRj';\nconsole.log(decode(encoded))\n```\n\nOutput:\n\n```js\n{\n  '0': 1747774361,\n  '1': 1,\n  '2': 14,\n  '3': 'bfcd22d7d1ba47225dad53efa7d69271',\n  '4': 'd41d8cd98f00b204e9800998ecf8427e',\n  '5': '40b54b1d67cb8370879a3b534bfc9208',\n  '6': 1746916919,\n  '7': 1245783967,\n  '8': 1248991792,\n  '9': '5.1.0'\n}\n```\n\n## About `X-Gnarly`\n\n`X-Gnarly` is just an object underneath. Here is its structure with few comments for context:\n\n```js\n{\n  \"0\":2024114372, // $6 XOR $7 XOR $8 XOR $1 XOR $2\n  \"1\":1, // envcode (1 means trusted/legitimate user-looking environment)\n  /*\n  ubcode - either 0,8,12,14.\n  didn't manage to infer the actual condition on which either one is chosen\n  but it seems the value is endpoint-dependant. 0 is the value for most\n  regular read/write endpoints.\n  */\n  \"2\":0,\n  \"3\":\"0170be42af9a30f1cb0158c024a36b3d\", // md5 of query string\n  \"4\":\"d41d8cd98f00b204e9800998ecf8427e\", // md5 of body (\"\" for GET requests)\n  \"5\":\"b977e10d1cb26107909e97d51a688323\", // md5 of user-agent\n  \"6\":1746388945, // unix ts\n  \"7\":1245783967, // static as of now, subject to change. canvas operation that can be generated in the browser using canvas.js.\n  \"8\":1525901451, // unix ts in microseconds % 2147483648\n  \"9\":\"5.1.0\" // sdk version\n}\n```\n\nAfter this object is crafted, it's encoded using some cryptography.\n\n## License\n\nThis repository is licensed under the [MIT License](./LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjustscrapeme%2Ftiktok-web-reverse-engineering","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjustscrapeme%2Ftiktok-web-reverse-engineering","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjustscrapeme%2Ftiktok-web-reverse-engineering/lists"}