← Back to Labs
JWT Verification Pitfalls
Run one token through a strict verifier, then compare what changes when algorithm policy, key lookup, storage, or revocation discipline gets sloppy.
algorithm
policy matched
signature
signature valid
claims
claims valid
verdict
token accepted
compact token
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InN5bW0tMjAyNi0wNSJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5ldSIsInN1YiI6InVzZXJfNDIiLCJhdWQiOiJiaWxsaW5nLWFwaSIsInNjb3BlIjoidHJhbnNmZXJzOndyaXRlIiwiaWF0IjoxNzc4NDk3ODAwLCJuYmYiOjE3Nzg0OTc4MDAsImV4cCI6MTc3ODQ5ODcwMCwianRpIjoiOWIzZDhkNTYtMmQ1OS00ZTRlLTg2ZDktOGY1M2Q0YzhlN2NlIn0.aHMyNTYtZGVtby1zaWduYXR1cmU
header
alg: HS256 typ: JWT kid: symm-2026-05
payload claims
iss: https://auth.example.eu sub: user_42 aud: billing-api scope: transfers:write iat: 1778497800 nbf: 1778497800 exp: 1778498700 jti: 9b3d8d56-2d59-4e4e-86d9-8f53d4c8e7ce
signature meaning
hs256-demo-signature
strict verifier pipeline
allow-list algorithm
accept HS256
trusted key lookup
kid symm-2026-05 resolved
signature verify
cryptographic check passed
claim policy
issuer, audience, and time accepted
session reality
HttpOnly cookie
why a sloppy verifier breaks
There is no trick here. This is the boring success path a verifier should accept.
Scenario controls
This token is structurally valid, uses the expected algorithm, resolves to a trusted symmetric key, and carries the right audience and expiry.
Step 1 / 6Split the token into header, payload, and signature segments
JWTs are usually just three base64url segments. The header and payload are readable to anyone holding the token, which is why a signed JWT is not an encrypted secret container.
Arrow keys to navigate · R to reset
Tap dots to jump to any step