Home GuidesJWT Security Testing Guide

JWT Security Testing Guide

Learn how to test JSON Web Token implementations for algorithm confusion, signature bypass, claim manipulation, and key disclosure vulnerabilities.

Advanced

6 steps17 payload examples~60 min

Authorized testing only. Only use these techniques on systems you have explicit permission to test.

Decode and analyze the token

Base64-decode the JWT header and payload to understand the algorithm, claims, and structure. Identify the signing algorithm (HS256, RS256, etc.), expiration, and custom claims that control access.

Example payloads

echo "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIn0.xxx" | cut -d. -f1 | base64 -d

Use Payload Playground JWT Decoder tool

Test the "none" algorithm attack

Change the algorithm in the header to "none" and remove the signature. If the server does not enforce algorithm verification, it will accept the unsigned token.

Example payloads

{"alg":"none","typ":"JWT"}

{"alg":"None","typ":"JWT"}

{"alg":"NONE","typ":"JWT"}

{"alg":"nOnE","typ":"JWT"}

Test algorithm confusion (RS256 to HS256)

If the server uses RS256 (asymmetric), try changing to HS256 (symmetric) and sign with the public key. The server may use the public key as the HMAC secret.

Example payloads

Header: {"alg":"HS256","typ":"JWT"}

Sign with the RSA public key as HMAC secret

Test claim manipulation

Modify payload claims to escalate privileges. Change user roles, user IDs, email addresses, or any claim used for authorization decisions. Re-sign with a weak or known secret.

Example payloads

{"sub":"admin","role":"administrator"}

{"user_id":1,"is_admin":true}

{"email":"admin@target.com"}

Brute-force weak secrets

If HS256 is used, attempt to brute-force the signing secret. Many applications use weak or default secrets. Tools like hashcat and jwt_tool can crack JWT secrets.

Example payloads

hashcat -a 0 -m 16500 jwt.txt wordlist.txt

jwt_tool TOKEN -C -d wordlist.txt

Common secrets: secret, password, 123456, key

Test expiration and refresh handling

Check if expired tokens are still accepted, if token revocation works, and if refresh tokens can be reused. Test for race conditions in token refresh flows.

Example payloads

Set "exp" to a past date and replay

Reuse a refresh token after rotation

Send expired access token without refresh

Related Resources

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

$loading...

Decode and analyze the token

Base64-decode the JWT header and payload to understand the algorithm, claims, and structure. Identify the signing algorithm (HS256, RS256, etc.), expiration, and custom claims that control access.

Example payloads

echo "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIn0.xxx" | cut -d. -f1 | base64 -d

Use Payload Playground JWT Decoder tool