JWT Structure

Header Information

Algorithm (alg)

Token Type (typ)

Key ID (kid)

Content Type (cty)

Signature (Base64URL Encoded)

Verification Status

Cannot verify without secret key

"none" Algorithm: Some libraries allow alg=none, bypassing signature verification entirely
Weak Secrets: HS256 with weak secret can be brute-forced. Prefer RS256 (asymmetric)
Expiry Bypass: Missing or ignored exp claim allows indefinite token reuse
Key Confusion: RSA public key used as HMAC secret when algorithm switches to HS256
Token Injection: Nested JWTs in claims without validation
Clock Skew: Improper handling of exp/iat claims with server time differences