← Back to Labs
JWT Verification Pitfalls
Run one token through a strict verifier, then compare what changes when algorithm policy, key lookup, storage, or revocation discipline gets sloppy.
algorithm
policy matched
signature
signature valid
claims
claims valid
verdict
token accepted
compact token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InN5bW0tMjAyNi0wNSJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5ldSIsInN1YiI6InVzZXJfNDIiLCJhdWQiOiJiaWxsaW5nLWFwaSIsInNjb3BlIjoidHJhbnNmZXJzOndyaXRlIiwiaWF0IjoxNzc4NDk3ODAwLCJuYmYiOjE3Nzg0OTc4MDAsImV4cCI6MTc3ODQ5ODcwMCwianRpIjoiOWIzZDhkNTYtMmQ1OS00ZTRlLTg2ZDktOGY1M2Q0YzhlN2NlIn0.aHMyNTYtZGVtby1zaWduYXR1cmU
header
alg: HS256
typ: JWT
kid: symm-2026-05
payload claims
iss: https://auth.example.eu
sub: user_42
aud: billing-api
scope: transfers:write
iat: 1778497800
nbf: 1778497800
exp: 1778498700
jti: 9b3d8d56-2d59-4e4e-86d9-8f53d4c8e7ce
signature meaning
hs256-demo-signature
strict verifier pipeline
allow-list algorithm
accept HS256
trusted key lookup
kid symm-2026-05 resolved
signature verify
cryptographic check passed
claim policy
issuer, audience, and time accepted
session reality
HttpOnly cookie
why a sloppy verifier breaks
There is no trick here. This is the boring success path a verifier should accept.
Scenario controls
This token is structurally valid, uses the expected algorithm, resolves to a trusted symmetric key, and carries the right audience and expiry.
Step 1 / 6Split the token into header, payload, and signature segments
JWTs are usually just three base64url segments. The header and payload are readable to anyone holding the token, which is why a signed JWT is not an encrypted secret container.
Arrow keys to navigate · R to reset
Tap dots to jump to any step