AuthenticationHighJSON Web Token attacks

JWT Issues

Misused JSON Web Tokens - alg confusion, none, weak secrets, and missing validation - break authentication.

Live Playground · Powered by this research

JWT Quick Decoder

Paste a JWT to inspect header, payload, and expiry inline.

Overview

Servers that don’t pin the algorithm or verify the signature accept alg:none, allow RS256→HS256 confusion (signing with the public key as HMAC secret), or fall to brute-forced weak HMAC secrets.

How it works

Servers that don’t pin the algorithm or verify the signature accept alg:none, allow RS256→HS256 confusion (signing with the public key as HMAC secret), or fall to brute-forced weak HMAC secrets.

Example

json

{"alg":"none","typ":"JWT"}.{"sub":"admin"}.   // accepted = full forgery

Impact

Token forgery, privilege escalation, and persistent account takeover.

Detection

Tamper alg/claims, test none and key-confusion, and attempt secret brute force on HS256 tokens.

Prevention

Pin the expected algorithm server-side and reject others (no none).
Use strong, rotated secrets / proper key management.
Validate signature, iss, aud, and exp on every request.
Keep token lifetimes short and support revocation.